i18n-translate
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Node.js script (
validate-namespace.mjs) to perform structural validation and glossary compliance checks on translation files. It also utilizes standard command-line utilities such asrg(ripgrep) for contextual research andgit difffor auditing changes before completion. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from repository localization JSON files and a glossary file while maintaining file-write and command execution capabilities. This represents an attack surface common to agents that manipulate text data.
- Ingestion points: Reads Simplified Chinese source files (
packages/web/i18n/zh-CN/*.json), existing target locale files, and a glossary definition file (references/fastgpt-glossary.json). - Boundary markers: The instructions emphasize structural and semantic alignment but do not include explicit instructions or markers to disregard instructions potentially embedded within the localized string values.
- Capability inventory: The skill has permissions to write to JSON files within the repository and execute scripts and standard development CLI tools.
- Sanitization: The included validation script checks for structural matching, glossary terms, and protected tokens (like interpolation variables) but does not scan for prompt injection sequences in the text content.
Audit Metadata