ucoz-site-translator-skill
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from uCoz sites for translation, which constitutes an attack surface for indirect prompt injection. However, the skill implements comprehensive mitigations: it mandates an inventory phase before translation, requires human-in-the-loop validation via previews for all changes, and strictly enforces the preservation of site variables and template syntax. Ingestion points: materials, categories, templates, menus, and pages read via uAPI and MCP. Sanitization: strict preservation rules and template validation procedures.
- [COMMAND_EXECUTION]: The skill uses a set of MCP tools (ucoz-mcp) to perform administrative tasks on uCoz sites. These operations are scoped to the site host and authenticated via user-managed credentials provided through the MCP connection context.
- [EXTERNAL_DOWNLOADS]: The skill references official uCoz OpenAPI schemas and documentation from the vendor domain (api.ucoz.net). These resources are used for operational accuracy and do not introduce untrusted code.
Audit Metadata