find-missing-translations

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a variety of shell commands including grep, sed, awk, and comm to parse and compare Android string resource files. It also executes ./gradlew to run Android lint, which involves local process execution within the project environment.
  • [EXTERNAL_DOWNLOADS]: The skill automates the installation of the babel Python package from the public PyPI registry into a temporary virtual environment for locale and plural form validation.
  • [DYNAMIC_EXECUTION]: The skill executes Python code and shell scripts provided as inline text (heredocs) to perform complex logic like checking CLDR plural rules and parsing lint results. This involves runtime execution of code patterns defined within the skill's instructions.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from repository files (strings.xml) and uses extracted values in shell command arguments, creating a potential surface for indirect influence if the source files contain malicious patterns.
  • Ingestion points: amethyst/src/main/res/values/strings.xml and commons/src/commonMain/composeResources/values/strings.xml (and locale-specific variants).
  • Boundary markers: Absent.
  • Capability inventory: Shell execution (grep, sed, awk, bash), Python execution, and Gradle build tasks.
  • Sanitization: Uses standard shell quoting (e.g., "$k") for extracted keys, but lacks comprehensive validation of the file content before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:22 AM