skills/labring/fastgpt/i18n-translate/Gen Agent Trust Hub

i18n-translate

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled Node.js script (validate-namespace.mjs) to perform structural validation and glossary compliance checks on translation files. It also utilizes standard command-line utilities such as rg (ripgrep) for contextual research and git diff for auditing changes before completion.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from repository localization JSON files and a glossary file while maintaining file-write and command execution capabilities. This represents an attack surface common to agents that manipulate text data.
  • Ingestion points: Reads Simplified Chinese source files (packages/web/i18n/zh-CN/*.json), existing target locale files, and a glossary definition file (references/fastgpt-glossary.json).
  • Boundary markers: The instructions emphasize structural and semantic alignment but do not include explicit instructions or markers to disregard instructions potentially embedded within the localized string values.
  • Capability inventory: The skill has permissions to write to JSON files within the repository and execute scripts and standard development CLI tools.
  • Sanitization: The included validation script checks for structural matching, glossary terms, and protected tokens (like interpolation variables) but does not scan for prompt injection sequences in the text content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:32 AM
Security Audit — agent-trust-hub — i18n-translate