Skills
skills/quantumnous/new-api/i18n-translate/Gen Agent Trust Hub

i18n-translate

Warn

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the generation and execution of temporary JavaScript files (find-missing-keys.mjs, find-untranslated.mjs, add-missing-keys.mjs) to automate translation tasks, involving direct script execution and file system access.
  • [COMMAND_EXECUTION]: The workflow utilizes shell commands such as bun run i18n:sync and node to manipulate project files and normalize localization data.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection. Ingestion points: Project source files and locale JSON files (web/default/src). Boundary markers: Absent. Capability inventory: File system write access and Node.js script execution. Sanitization: Absent. Malicious instructions embedded in source code strings could potentially influence the agent's behavior during the translation workflow.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 12, 2026, 07:26 AM