Skills localhero

📦

localhero

Name: localhero
Author: localheroai

Content revision r2 Medium Risk 🔑 Env variables⚙️ External commands🌐 Network access

Manage Localhero.ai Translation Workflows

Internationalized projects need consistent source strings, keys, glossary terms, and translation updates. This skill applies project conventions and runs Localhero.ai workflows.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "localhero" from https://skillstore.io/skills/localheroai-localhero.md and its manifest at https://skillstore.io/api/skills/localheroai-localhero/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/localheroai-localhero.md Signed manifest GET /api/skills/localheroai-localhero/manifest Signed lockfile GET /api/skills/localheroai-localhero/lockfile

Test it

Using "localhero". Add a source string for the save button on the profile page.

Expected outcome:

Added the profile save label using the existing action-key convention. Target-language files were not edited.

Using "localhero". Check whether this repository translates strings automatically.

Expected outcome:

Reviewed the Localhero configuration and GitHub workflow paths.
Automatic translation is enabled for the configured translation directories.
No Localhero CLI command was run.

Using "localhero". Prepare changed source strings for translation.

Expected outcome:

The changed source strings are ready. Running Localhero may upload project text and modify translation files, so approval is required.

Security Audit

Medium Risk

v7 • 8/8/2026 Open versioned report

Most static findings are Markdown false positives involving inline code, example identifiers, and legitimate Localhero.ai links. The skill does direct agents to execute an external npm package, upload source strings, and handle an API key, including one unsafe command-line option.

Files scanned

340

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:28-30 cli-reference.md:16-24

Project Source Strings Sent to External Service

The translation workflow runs a third-party CLI that may send changed source strings to Localhero.ai without an explicit confirmation step.

The workflow explicitly directs translation execution, and the CLI reference states that push sends source files to Localhero.ai.

Medium

cli-reference.md:111

Credential File Deletion Guidance

The CLI reference advises removing .localhero_key to override stale authentication, which could delete a local credential without a recovery step.

The line directly instructs removal of a named credential file, although it does not provide the deletion command.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:86

Generic API/secret keys

For non-interactive environments, they can also use `npx @localheroai/cli login --api-key <key>` or

The guidance permits placing a real API key in a command argument, where it may be retained in shell history or exposed to process inspection.

Medium

SKILL.md:30

Ruby/shell backtick execution

- Otherwise, run `npx @localheroai/cli translate --changed-only`. This translates only keys that dif

The skill explicitly directs the agent to run an npx package that contacts a translation service and modifies project translation files.

Medium

SKILL.md:72-76

Ruby/shell backtick execution

Run `npx @localheroai/cli glossary --output json` to get the project glossary. Use these terms consi

The line explicitly tells the agent to execute the Localhero npm CLI to retrieve glossary data from the external project.

Medium

SKILL.md:76-82

Ruby/shell backtick execution

Run `npx @localheroai/cli settings --output json` to get the project's tone, style, and language set

The line explicitly invokes the external Localhero npm CLI to retrieve project settings.

Medium

SKILL.md:82-84

Ruby/shell backtick execution

```bash

The cited block contains an npx login command that launches an external npm package for authentication.

Medium

SKILL.md:86

Ruby/shell backtick execution

For non-interactive environments, they can also use `npx @localheroai/cli login --api-key <key>` or

The line recommends executing an external npm CLI with an API-key argument. Command arguments may be exposed through shell history or process inspection.

Medium

SKILL.md:92-97

Ruby/shell backtick execution

```bash

The cited shell block invokes the Localhero npm CLI in non-interactive mode and can create configuration or import project files.

Risk Factors

🔑 Env variables (6)

cli-reference.md:67 cli-reference.md:109 cli-reference.md:111 cli-reference.md:173 SKILL.md:86 SKILL.md:101

⚙️ External commands (24)

🌐 Network access (4)

SKILL.md:9 SKILL.md:34 SKILL.md:86 SKILL.md:107

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/localheroai-localhero/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/localheroai-localhero/security.svg)](https://skillstore.io/skills/localheroai-localhero?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/localheroai-localhero?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/localheroai-localhero/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/localheroai-localhero.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

localheroai. (2026). localhero security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/localheroai-localhero/audits/7

BibTeX citation

@techreport{localheroai-localheroai-localhero-2026,
  author = {localheroai},
  title = {localhero security audit report (audit version 7)},
  institution = {Skillstore},
  year = {2026},
  number = {7},
  url = {https://skillstore.io/skills/localheroai-localhero/audits/7},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "localhero security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
  - name: "localheroai"
date-released: "2026-08-08"
url: "https://skillstore.io/skills/localheroai-localhero/audits/7"
identifiers:
  - type: other
    value: "skillstore:localheroai-localhero:audit:7"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Product Interface Copy

Add source-language labels and messages while preserving the application naming pattern and voice.

Maintain Localization Consistency

Apply approved glossary terms and project style settings across new interface strings.

Configure Monorepo Translation Paths

Review translation directories and coordinate Localhero workflows across multiple applications.

Try These Prompts

Add a Source String

Add a source-language string for [interface element]. Follow the existing localization key pattern and do not write target-language values.

Update Feature Copy

Update the source copy for [feature]. Review localhero.json, existing keys, glossary terms, and project style before editing.

Prepare Translation Changes

Review changed source strings for [branch]. Explain the translation workflow, then request approval before running external Localhero commands.

Audit a Monorepo Setup

Audit Localhero configuration across [applications]. Compare translation paths, key conventions, workflow triggers, glossary use, and missing translation risks.

Best Practices

Review localhero.json and existing source files before changing localization keys.
Use project glossary terms and style settings consistently.
Confirm external CLI operations before uploading content or modifying translation files.

Avoid

Do not write target-language values directly when Localhero manages them.
Do not pass API keys through command arguments or expose credential files.
Do not run broad translation commands before checking automated workflows and changed files.