lov-i18n-check-i18n
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Includes local Python scripts
profile_store.pyandvalidate_skill.pyfor managing project-specific profiles and validating the skill's source structure. - [DATA_EXFILTRATION]: Persists user and brand context to local configuration files (e.g.,
~/.config/agent-skills/profile.json). The management scriptprofile_store.pyexplicitly blocks the storage of sensitive fields like tokens, secrets, and passwords. - [INDIRECT_PROMPT_INJECTION]: The skill scans JSX and other source files for hardcoded strings to generate translation keys. 1. Ingestion points: User-visible text, placeholders, and notification strings in project source files. 2. Boundary markers: Employs stable key generation and ICU syntax for managing extracted content. 3. Capability inventory: File system modification, local JSON read/write, and execution of local Python scripts. 4. Sanitization: Validates translation file integrity and ensures stable key mapping.
- [EXTERNAL_DOWNLOADS]: References the
PyYAMLPython package as a dependency and mentions installation via the standardnpxpackage runner.
Audit Metadata