golang-cli-review
Pass
Audited by Gen Agent Trust Hub on Feb 15, 2026
Risk Level: LOWPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection (LOW): The skill is designed to ingest and analyze untrusted external content (Go source code), creating a surface for injection attacks where malicious code comments could influence agent behavior. 1. Ingestion points: workflow in SKILL.md requires reading all Go files in a project. 2. Boundary markers: Absent; the instructions do not use delimiters or provide a 'system-vs-user' context separation for the analyzed code. 3. Capability inventory: The skill's capabilities are limited to generating a checklist; it does not have the ability to execute code, make network requests, or modify local files. 4. Sanitization: No sanitization or filtering of input code is defined.
- Security Posture (SAFE): The skill reference documentation correctly identifies and warns against critical vulnerabilities like shell injection and hardcoded secrets, demonstrating that the tool is intended for legitimate security-focused auditing.
Audit Metadata