ucoz-site-translator-skill

Pass

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from uCoz sites, which constitutes an indirect prompt injection surface. This risk is effectively mitigated by comprehensive instructions that require the agent to preserve technical tokens, validate content formats, and obtain user approval through detailed translation plans.
  • Ingestion points: Site content is ingested from the target uCoz site via MCP tools such as content_read, forum_read, shop_read, templates_read, and files_read as detailed in SKILL.md and references/UAPI.md.
  • Boundary markers: The skill defines strict preservation rules in references/PRESERVATION_RULES.md to keep uCoz variables (e.g., $TITLE$), template syntax (e.g., <?if?>), and the $POWERED_BY$ marker byte-for-byte unchanged.
  • Capability inventory: The skill utilizes the ucoz-mcp toolset, providing CRUD access to site materials, categories, templates, menus, and files.
  • Sanitization: references/CONTENT_FIELDS_AND_FORMATS.md requires the agent to detect source formats (HTML, BBCode, Plain), use matching controls on write, and perform post-write verification to ensure no content corruption or escaping errors occurred.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 7, 2026, 10:21 AM