i18next
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes processing external translation files and dynamic variables. While it includes security best practices like XSS escaping and disabling variable nesting for user-provided data, the ingestion of untrusted external content remains a potential attack surface.
- Ingestion points: Translation resources loaded via backends or dynamic imports as seen in SKILL.md and configuration.md.
- Boundary markers: Interpolation syntax {{ }} and nesting $t() are utilized.
- Capability inventory: The t() function performs string manipulation and replacement based on the processed resources.
- Sanitization: Mentions escapeValue for XSS protection and skipOnVariables to prevent nested instruction resolution in user-provided variables.
- [DYNAMIC_EXECUTION]: Examples demonstrate lazy loading translation files using dynamic import() with computed paths.
- Evidence: Found in SKILL.md and references/configuration.md as part of recommended optimization patterns for web applications.
- [EXTERNAL_DOWNLOADS]: The documentation references and recommends various official i18next ecosystem packages for installation via npm.
- Evidence: Mentions standard packages including i18next, react-i18next, and several official backend and detector plugins.
Audit Metadata