lokalise-performance-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate instructions for optimizing Lokalise API usage. No malicious patterns, obfuscation, or unauthorized access attempts were detected.
- [COMMAND_EXECUTION]: Contains standard curl commands for benchmarking and webhook configuration targeting official Lokalise API endpoints (api.lokalise.com).
- [DATA_EXFILTRATION]: Implements a local caching mechanism in a .lokalise-cache directory to reduce API calls, which is an intended performance feature. Sensitive tokens are correctly handled via environment variables.
- [INDIRECT_PROMPT_INJECTION]: The skill interactions with external data represent a potential surface for indirect prompt injection. 1. Ingestion points: Lokalise API projects and keys endpoints (SKILL.md). 2. Boundary markers: None present in examples. 3. Capability inventory: includes network fetch, curl, and writeFileSync. 4. Sanitization: handled by standard JSON parsing of API responses. The risk is evaluated as safe for this specific use case.
Audit Metadata