i18n
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands for package management (npm, yarn, pnpm) and framework-specific validation tools (flutter analyze, tsc) to install dependencies and verify project integrity.
- [EXTERNAL_DOWNLOADS]: Downloads reputable internationalization libraries such as react-intl, vue-i18n, and i18next from official package registries like npm and pub.dev.
- [INDIRECT_PROMPT_INJECTION]: The skill reads untrusted source code across the entire project and performs high-privilege actions like modifying source files and executing shell commands. 1. Ingestion point: Phase 2 (Scanning the source tree for user-facing strings). 2. Boundary markers: Absent; there are no delimiters or safety instructions provided to the agent regarding potential instructions embedded in the extracted strings. 3. Capability inventory: Includes project-wide file write access (Phase 5) and shell command execution for dependency installation and testing (Phases 4 and 6). 4. Sanitization: Absent; extracted strings are processed and inserted into locale files without explicit sanitization or validation.
- [PERSISTENCE_MECHANISMS]: Maintains execution history by appending metadata to a persistent telemetry file in a hidden directory (~/.claude/projects/skill-telemetry.md) for self-evolution purposes.
Audit Metadata