The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data sources including application source code (via grep) and translation files (JSON format) downloaded from Lokalise. This creates a surface where malicious content embedded in these files could theoretically influence agent behavior.\n
Ingestion points: Reads files in src/ directory and translation files in src/locales/ or temporary directories.\n
Boundary markers: No explicit delimiters or instructions are used in the provided bash and TypeScript scripts to isolate processed data from the agent's control flow.\n
Capability inventory: The skill uses Bash, curl, lokalise2, and Grep to interact with the filesystem and network.\n
Sanitization: Content is parsed using jq and JSON.parse, but results are output directly to the console which the agent reads.\n- [EXTERNAL_DOWNLOADS]: The skill uses the lokalise2 CLI and curl to fetch translation bundles and project metadata from official Lokalise infrastructure (api.lokalise.com, ota.lokalise.com). These are well-known services relevant to the skill's purpose.\n- [COMMAND_EXECUTION]: Executes various shell commands and scripts to perform audits, including git log to search for accidentally committed secrets and grep to extract translation keys from source code.

lokalise-prod-checklist