translations

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The helper script helpers/translation-batch-manager.php uses the PHP include statement to load translation catalogs from the filesystem. This results in the execution of any PHP code contained within those files as they are loaded into the script's memory.- [COMMAND_EXECUTION]: The utility performs syntax validation on generated PHP translation files by executing php -l via shell_exec. The command construction uses escapeshellarg to sanitize file paths. The documentation also includes examples of using docker exec and redis-cli for system maintenance tasks.- [INDIRECT_PROMPT_INJECTION]: The skill processes translation strings that may be supplied by external contributors or generated by AI models. It manages this risk through specific prompt design and post-translation validation.
  • Ingestion points: Local PHP translation catalogs in src/Common/Messages/ and batch JSON files used for incremental updates.
  • Boundary markers: The AI prompt templates in reference/ai-prompts.md include explicit instructions for the model to return only the translated PHP array values, acting as a structural constraint.
  • Capability inventory: The skill includes functions to read and write files and to execute local shell commands for syntax checking.
  • Sanitization: The batch manager utilizes addcslashes to escape keys and values during PHP code generation and escapeshellarg to prevent command injection when performing syntax checks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 06:27 AM
Security Audit — agent-trust-hub — translations