lokalise-install-auth

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill uses sudo to move the lokalise2 binary to /usr/local/bin/. While this is a common requirement for global installation of CLI tools on Linux, it involves executing commands with elevated permissions.
  • [EXTERNAL_DOWNLOADS]: Fetches the latest release version from the official Lokalise GitHub repository and downloads the compiled Linux binary to the local system.
  • [COMMAND_EXECUTION]: Performs automated package installation using npm and brew, and uses curl piped to tar for manual binary extraction and installation.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote API which is then used to construct a download URL.
  • Ingestion points: The LATEST_CLI variable is populated from the GitHub API response for the latest release tag in SKILL.md.
  • Boundary markers: No specific boundary markers or "ignore" instructions are present for the interpolated version string.
  • Capability inventory: The skill uses curl, tar, sudo mv, and npm install across the installation steps.
  • Sanitization: The version string is filtered using grep -oP with a regular expression, which provides basic character set validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:47 AM
Security Audit — agent-trust-hub — lokalise-install-auth