lokalise-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command syntax to automatically execute node --version, python3 --version, and uname -a when the skill is loaded. These commands are used for environment detection and are considered low risk.
  • [COMMAND_EXECUTION]: The skill performs extensive shell command execution using curl, jq, sed, grep, and tar to gather system diagnostics and project metadata.
  • [DATA_EXFILTRATION]: The skill accesses potentially sensitive local files including ~/.npm/_logs/ and .env to collect diagnostic information. While it includes sed-based redaction logic to remove API tokens and email addresses before bundling the data, there is an inherent risk of sensitive data exposure if redaction patterns are bypassed or incomplete.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the official Lokalise API (api.lokalise.com) to verify connectivity and retrieve project statistics. This is a well-known service directly related to the skill's purpose.
  • [DYNAMIC_EXECUTION]: Uses node -e to programmatically check the version of the @lokalise/node-api package by reading its package.json file.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:49 AM
Security Audit — agent-trust-hub — lokalise-debug-bundle