golang-pkg-go-dev
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of a third-party command-line tool,
godig, from a repository not associated with the provided trusted organization list. - Evidence: Instructions recommend running
go install github.com/samber/godig/cmd/godig@latestto enable the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of content from the public Go package ecosystem (pkg.go.dev), creating a surface for indirect prompt injection.
- Ingestion points: The skill fetches full package documentation, module READMEs, and runnable examples using commands like
package doc,module readme, andpackage examplesfromSKILL.md. - Boundary markers: There are no specific boundary markers or instructions to treat the retrieved documentation as untrusted data that should not be executed or obeyed.
- Capability inventory: The agent, upon receiving instructions from malicious documentation, could potentially use other skills or tools in its environment to perform unauthorized actions.
- Sanitization: No sanitization or filtering of the fetched content is implemented; the data is passed directly to the agent in Markdown or raw format.
Audit Metadata