find-missing-translations
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a variety of shell commands including
grep,sed,awk, andcommto parse and compare Android string resource files. It also executes./gradlewto run Android lint, which involves local process execution within the project environment. - [EXTERNAL_DOWNLOADS]: The skill automates the installation of the
babelPython package from the public PyPI registry into a temporary virtual environment for locale and plural form validation. - [DYNAMIC_EXECUTION]: The skill executes Python code and shell scripts provided as inline text (heredocs) to perform complex logic like checking CLDR plural rules and parsing lint results. This involves runtime execution of code patterns defined within the skill's instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from repository files (
strings.xml) and uses extracted values in shell command arguments, creating a potential surface for indirect influence if the source files contain malicious patterns. - Ingestion points:
amethyst/src/main/res/values/strings.xmlandcommons/src/commonMain/composeResources/values/strings.xml(and locale-specific variants). - Boundary markers: Absent.
- Capability inventory: Shell execution (
grep,sed,awk,bash), Python execution, and Gradle build tasks. - Sanitization: Uses standard shell quoting (e.g.,
"$k") for extracted keys, but lacks comprehensive validation of the file content before processing.
Audit Metadata