Versioned security assessment

Report ID: SA-29E4F58B

6/30/2026, 7:46:09 AM

localhero security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: localhero
Version: v2
Maintainer: localheroai
Source: github.com/localheroai/agent-skill/tree/main/
Coverage: 4 Files scanned · 245 Lines analyzed
Policy version: Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static command-execution findings are mostly markdown examples for the Localhero.ai CLI, not hidden executable code. The confirmed risk is medium because the skill allows Bash access to `npx @localheroai/cli *`, uses a network service, reads and writes project translation files, and documents API key authentication. No prompt injection, obfuscation, weak cryptography, or malicious exfiltration intent was found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

4 Files scanned · 245 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 7 evidence locations

Filesystem access

May read or write local files.

Observed in 5 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 9 evidence locations

Capability review items (4)

Medium

SKILL.md:4 SKILL.md:30 cli-reference.md:9-14 cli-reference.md:20-24

Network-Enabled CLI Execution Is Allowed

The skill grants Bash access to `npx @localheroai/cli *` and instructs agents to run Localhero.ai CLI commands. This is legitimate for the skill purpose, but it can execute an external npm package, contact Localhero.ai, and modify project translation files.

The allowed-tools declaration and workflow commands directly authorize Localhero CLI execution. The behavior is expected for an i18n CLI skill, so the concern is operational risk rather than confirmed malicious intent.

Medium

SKILL.md:65 cli-reference.md:63-67 cli-reference.md:120

API Key Handling Requires Care

The documentation includes non-interactive login with an API key and the LOCALHERO_API_KEY environment variable. Passing secrets on a command line can expose them through shell history or process inspection, so users should prefer environment or secret-manager workflows.

The API key usage is documented explicitly and is a common authentication pattern. The risk is credible because command-line secrets can leak, but there is no evidence the skill exfiltrates credentials.

Medium

SKILL.md:24-30 cli-reference.md:18-24 cli-reference.md:29-34 cli-reference.md:77-83

Translation Commands Can Modify Project Files

The skill directs agents to add or modify source locale keys and run commands that push, pull, clone, or translate files. This is expected functionality, but users should review diffs because generated translations and CLI operations may change repository content.

The workflow and CLI reference clearly describe file-changing translation operations. This matches the product purpose, but it creates filesystem impact that should be disclosed.

Low

cli-reference.md:121

API Host Override Could Be Misused If Untrusted

The CLI reference documents LOCALHERO_API_HOST for development. This is not malicious by itself, but users should not set it from untrusted instructions because it could redirect API traffic.

The setting is explicitly documented as a development override, which is legitimate. The risk depends on user configuration and no misuse is shown in the skill files.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)

Low

README.md:3 README.md:15 README.md:23-25 SKILL.md:9 SKILL.md:34 SKILL.md:69

Hardcoded URLs Are Product and Documentation Links

The network URL matches point to Localhero.ai, npm package documentation, Claude Code documentation, Cursor documentation, GitHub, and skills.sh. They are user-facing documentation or service links, not hidden endpoints.

The URLs are visible in markdown documentation and align with the stated Localhero.ai translation workflow. No suspicious or unrelated network destination was found.

Low

SKILL.md:3 SKILL.md:46 cli-reference.md:118-121

Static Weak-Crypto and Reconnaissance Matches Are False Positives

The reported weak cryptography and system reconnaissance lines are markdown text or table formatting, not cryptographic code or system probing logic. No evidence found for weak crypto usage or reconnaissance behavior.

Line review shows product description, gettext documentation, and environment variable table rows. These locations do not contain executable cryptographic or reconnaissance code.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable