lokalise-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing official dependencies, including the Lokalise Node.js SDK (
@lokalise/node-api) via NPM and the Lokalise CLI tool (lokalise2) via Homebrew or official GitHub releases. These are standard and verifiable tools for the service. - [COMMAND_EXECUTION]: The instructions include bash commands for project initialization and interacting with the Lokalise CLI. These commands are typical for developer setup and do not perform unexpected or high-risk operations.
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing users to export sensitive API tokens to environment variables (
LOKALISE_API_TOKEN) and utilizing thedotenvlibrary, rather than hardcoding credentials in scripts. - [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for handling external data in the form of translation strings. While this introduces a theoretical injection surface common to all localization tools, the examples are static and intended for learning basic API functionality, posing no immediate risk to the agent's autonomy or safety.
Audit Metadata