lokalise-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill performs translation data migration using official, well-known API endpoints for Crowdin, Phrase, POEditor, and Lokalise.
- [SAFE]: Authentication is managed through environment variables such as LOKALISE_API_TOKEN, which is a standard and secure practice for credential handling.
- [SAFE]: Dynamic context injection (
!command) is used purely for environment diagnostics, such as checking tool versions and installation status. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and transforms external translation files from source TMS platforms. While these files are untrusted data, the risk is limited to data transformation errors and does not grant unauthorized command execution capabilities to the data source. Evidence: Step 2 in SKILL.md and Step 3 in implementation-guide.md describe flattening and normalizing untrusted JSON inputs.
Audit Metadata