lovstudio-translation-review
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
pandocshell command to convert.docxfiles into plain text for processing. This is a standard operation required for document analysis functionality. - [EXTERNAL_DOWNLOADS]: The documentation references the installation of the skill via
npx lovstudioand the installation of the well-known document converterpandocviabrew. These are legitimate dependencies from the vendor and established services. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted external files (Chinese originals and English translations).
- Ingestion points: User-provided
.docx,.md, and.txtdocuments processed in Step 2 of the workflow. - Boundary markers: No explicit boundary markers or instruction-ignoring warnings are used when the content of these files is passed to the AI for review.
- Capability inventory: The skill can execute shell commands (
pandoc) and write files to the local directory (Step 6). - Sanitization: There is no evidence of sanitization or filtering of the content within the documents before analysis.
Audit Metadata