bootstrap-go-cli
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands to initialize directory structures, initialize Go modules, and build the application (e.g.,
mkdir,go mod init,go build,git init). - [EXTERNAL_DOWNLOADS]: The skill fetches the
cobraandviperlibraries from their official repositories viago getto install project dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input and interpolates it into shell commands and file templates, relying on the agent's internal guardrails rather than explicit skill-level sanitization.
- Ingestion points: User-provided application name, module path, and subcommand names defined in
SKILL.md. - Boundary markers: Absent; the instructions do not provide delimiters or warnings for the agent when handling these inputs.
- Capability inventory: Full shell command execution and file system write access within the project directory.
- Sanitization: Absent; there are no instructions for escaping or validating user-provided strings before they flow into shell execution.
Audit Metadata