lokalise-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides code patterns for uploading locale files which involve reading from the local filesystem via dynamic paths.
- Ingestion points: The
uploadWithProgressfunction inSKILL.mdaccepts afilePathparameter that dictates which file is read from the disk. - Boundary markers: The provided code snippets do not include explicit path validation or boundary checks to ensure only translation files are accessed.
- Capability inventory: The skill demonstrates the use of
fs.readFileSyncin conjunction with the@lokalise/node-apiupload method, which sends file contents to an external service. - Sanitization: Input sanitization for the file path is not demonstrated in the pattern, relying on the implementing agent to verify the safety of the source path.
Audit Metadata