Skills
Navigate
skills/liuchiawei/agent-skills/next-intl-app-router/Gen Agent Trust Hub

next-intl-app-router

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted input from the URL locale segment ([locale]) which is used to dynamically load translation files. The implementation follows security best practices by validating the input against a strict whitelist before use.
  • Ingestion points: The locale parameter is extracted from params in app/[locale]/layout.tsx and app/[locale]/page.tsx.
  • Boundary markers: Not applicable as the data is used for file resolution rather than prompt construction.
  • Capability inventory: The skill uses dynamic import() in src/i18n/request.ts to load JSON files from the messages/ directory.
  • Sanitization: The locale variable is validated using hasLocale(routing.locales, requested) in src/i18n/request.ts, where routing.locales is a hardcoded list of allowed language codes (en, ja, zh-CN, zh-TW). This prevents directory traversal or arbitrary file inclusion attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 05:46 PM