lov-academic-translator
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions specify commands for the user to install and decrypt content using vendor-managed tools.
- Evidence:
SKILL.mdincludesnpx lovstudio skills add academic-translatoranduvx lovstudio-skill-helper decrypt academic-translator. - Context: These tools are provided by the author
lovstudiofor managing paid skills. - [EXTERNAL_DOWNLOADS]: The skill downloads and manages encrypted code files using a manifest, which are decrypted at runtime.
- Evidence:
MANIFEST.enc.jsondefines AES-256-GCM encryption for all script files. - [PROMPT_INJECTION]: The skill processes user-supplied PDFs for translation, which is a surface for indirect prompt injection attacks.
- Ingestion points: Academic PDFs, technical journals, and technical articles processed via
scripts/translate_paper_pdf.py. - Boundary markers: Unverifiable due to source code encryption.
- Capability inventory: PDF processing and translation logic in
scripts/translate_paper_pdf.py. - Sanitization: Unverifiable due to source code encryption.
Audit Metadata