The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install security tooling from well-known repositories.
Evidence: The command go install golang.org/x/vuln/cmd/govulncheck@latest is recommended for vulnerability scanning in SKILL.md.
Evidence: The command go get -tool github.com/securego/gosec/v2/cmd/gosec@latest is recommended for static analysis in SKILL.md.
[COMMAND_EXECUTION]: The skill provides instructions to run shell commands to perform security verification, linting, and testing on Go codebases.
Evidence: SKILL.md includes commands such as go tool gosec ./..., go tool govulncheck ./..., go test -race ./..., and go test -fuzz=Fuzz.
[INDIRECT_PROMPT_INJECTION]: The skill defines a framework for analyzing untrusted source code. This creates a surface for indirect prompt injection where malicious instructions embedded in the code being analyzed could influence the agent, particularly given its capability to execute build and test tools.
Ingestion points: Go source code files provided by the user for review or audit, as described in the "Review mode" and "Audit mode" sections of SKILL.md.
Boundary markers: There are no explicit instructions or delimiters defined to isolate the content of the analyzed files from the agent's internal reasoning.
Capability inventory: The skill utilizes shell command execution via go tool, go test, and go build for analysis and verification (referenced in SKILL.md and references/memory-safety.md).
Sanitization: No sanitization is applied to the analyzed code before it is passed to standard Go tooling for execution or scanning.

golang-security