The Agent Skills Directory

[SAFE]: The skill operates as a reference guide for Go developers, promoting well-maintained and industry-standard libraries. No malicious commands, exfiltration patterns, or obfuscation were detected.
[METADATA_POISONING]: There is an inconsistency between the internal metadata author ('samber') and the platform-reported author ('bateau84'). This appears to be a neutral attribution to the original creator of the referenced Go libraries ('samber'), rather than a deceptive attempt to impersonate.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection because it can ingest external content via WebFetch and WebSearch tools and read local project files (e.g., go.mod).
Ingestion points: WebFetch, WebSearch, Read, and Glob tools allow the agent to process data from external websites and local files.
Boundary markers: No explicit instruction delimiters or markers are defined to isolate untrusted external content.
Capability inventory: The skill is granted restricted shell access via Bash(go:*), Bash(git:*), and Bash(golangci-lint:*), as well as file modification via Write and Edit tools.
Sanitization: No explicit sanitization or validation of external input is implemented.
Conclusion: The risk is significantly mitigated by the highly restricted scope of the Bash tool, which limits execution to specific, expected development commands.

golang-popular-libraries