vtex-io-messages-and-i18n
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard documentation for VTEX IO's internationalization system. It includes hard constraints that prevent the misuse of message files for storing sensitive data like credentials or business logic, which aligns with secure development practices.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing external data from translation files which are then interpolated into UI components and API responses. This represents a potential surface for indirect prompt injection if the source translation files are manipulated by an attacker.
- Ingestion points: Translation files located at
/messages/*.jsonand GraphQLIOMessagestructures. - Boundary markers: No specific delimiters or "ignore" instructions are prescribed for the translation payloads.
- Capability inventory: React rendering via
FormattedMessageand backend GraphQL resolvers. - Sanitization: The instructions do not specify sanitization or validation steps for the content of the translation files.
Audit Metadata