lokalise-deploy-integration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Lokalise CLI binary directly from the official GitHub repository during Netlify build plugin execution and Docker image construction (e.g.,
https://github.com/lokalise/lokalise-cli-2-go/releases/latest/download/lokalise2_linux_x86_64.tar.gz). - [REMOTE_CODE_EXECUTION]: The implementation guides instruct the agent to download, extract, and execute the Lokalise CLI binary within CI/CD and container environments to perform translation synchronization.
- [COMMAND_EXECUTION]: The skill utilizes shell scripts and Node.js
child_process.execSyncto manage environment variables, trigger build-time downloads, and execute platform-specific deployment commands (Vercel, Netlify, and GCloud). - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes external content from the Lokalise API.
- Ingestion points: Fetches translation bundles from
api.lokalise.comand GitHub-hosted CLI binaries. - Boundary markers: The skill includes integrity checks using
jqto validate that downloaded files are valid JSON and that expected language files are present. - Capability inventory: Access to the
BashandWritetools, filesystem operations for localized files, and network access for API communication. - Sanitization: While it validates JSON structure, it does not sanitize the actual translation strings against potential natural language instructions that could influence downstream agent behavior.
Audit Metadata