google-translate
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input which is then interpolated into shell commands. There is a risk that malicious input containing shell metacharacters could lead to command injection if not handled by the underlying execution layer.
- Ingestion points: User-supplied content passed to the
<text>parameter in therobomotion googletranslate translatecommand (defined in SKILL.md). - Boundary markers: None provided. There are no instructions for the agent to use delimiters or to treat the input as literal text.
- Capability inventory: The skill utilizes command-line execution via the
robomotionCLI. - Sanitization: No explicit sanitization or escaping instructions are included in the skill definition to protect against shell injection.- [COMMAND_EXECUTION]: The skill is entirely built around the execution of the
robomotionCLI tool. It requires the installation of a specific package (robomotion install googletranslate) and executes multiple subcommands (connect, translate, disconnect) to perform its primary function.
Audit Metadata