translations
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The helper script
helpers/translation-batch-manager.phpuses the PHPincludestatement to load translation catalogs from the filesystem. This results in the execution of any PHP code contained within those files as they are loaded into the script's memory.- [COMMAND_EXECUTION]: The utility performs syntax validation on generated PHP translation files by executingphp -lviashell_exec. The command construction usesescapeshellargto sanitize file paths. The documentation also includes examples of usingdocker execandredis-clifor system maintenance tasks.- [INDIRECT_PROMPT_INJECTION]: The skill processes translation strings that may be supplied by external contributors or generated by AI models. It manages this risk through specific prompt design and post-translation validation. - Ingestion points: Local PHP translation catalogs in
src/Common/Messages/and batch JSON files used for incremental updates. - Boundary markers: The AI prompt templates in
reference/ai-prompts.mdinclude explicit instructions for the model to return only the translated PHP array values, acting as a structural constraint. - Capability inventory: The skill includes functions to read and write files and to execute local shell commands for syntax checking.
- Sanitization: The batch manager utilizes
addcslashesto escape keys and values during PHP code generation andescapeshellargto prevent command injection when performing syntax checks.
Audit Metadata