autor3search-go
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs a command-line tool from a remote GitHub repository using
go install github.com/autor3search/go/cmd/autor3search-go@latest. This is a resource provided by the skill author. - [COMMAND_EXECUTION]: The agent is instructed to run several shell commands including
go install,go env,git, and the subcommands of theautor3search-goutility (init,doctor,baseline,report). - [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read
program.mdand treat it as the authoritative instruction set for the session, explicitly stating to "Follow it exactly." This creates a potential vulnerability if the processed repository contains malicious instructions within that file. - Ingestion points: Local file
program.mdin the repository being optimized. - Boundary markers: Absent. The instructions command the agent to follow the file's content without reservation.
- Capability inventory: The agent has permissions to modify local files, execute git commands, and run the optimization CLI tool.
- Sanitization: No sanitization or validation logic is defined for the content of the external instruction file.
Audit Metadata