The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a 'Review mode' meant to audit existing Go code for design issues such as init() abuse or implicit global state. This functionality relies on processing user-provided code, which could potentially contain malicious instructions embedded in comments or string literals designed to influence the agent's behavior.
Ingestion points: User-supplied Go source code files or snippets provided during the 'Review mode' workflow.
Boundary markers: The instructions do not specify the use of clear delimiters or guardrails (e.g., XML tags or Markdown blocks) to isolate untrusted code from instructions.
Capability inventory: The skill itself provides instructional logic, but the agent's environment may grant capabilities like file writing or network access that could be targeted by an injection.
Sanitization: There is no mention of sanitizing or filtering input code before analysis.
[SAFE]: The skill promotes security best practices, such as using crypto/rand for token generation instead of math/rand, and implementing timeouts for all external calls to prevent resource exhaustion.
[SAFE]: External references to packages like github.com/samber/ro target well-known open-source contributors in the Go community and are used to illustrate idiomatic streaming patterns.

golang-design-patterns