lokalise-install-auth
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill uses
sudoto move thelokalise2binary to/usr/local/bin/. While this is a common requirement for global installation of CLI tools on Linux, it involves executing commands with elevated permissions. - [EXTERNAL_DOWNLOADS]: Fetches the latest release version from the official Lokalise GitHub repository and downloads the compiled Linux binary to the local system.
- [COMMAND_EXECUTION]: Performs automated package installation using
npmandbrew, and usescurlpiped totarfor manual binary extraction and installation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a remote API which is then used to construct a download URL.
- Ingestion points: The
LATEST_CLIvariable is populated from the GitHub API response for the latest release tag inSKILL.md. - Boundary markers: No specific boundary markers or "ignore" instructions are present for the interpolated version string.
- Capability inventory: The skill uses
curl,tar,sudo mv, andnpm installacross the installation steps. - Sanitization: The version string is filtered using
grep -oPwith a regular expression, which provides basic character set validation.
Audit Metadata