golang-cli-cobra-viper
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill manifest and documentation attribute the author to 'Claude MPM Team', which contradicts the platform's attribution to 'bobmatnyc'. This mismatch is potentially misleading regarding the official status and origin of the skill.
- [EXTERNAL_DOWNLOADS]: The skill code references industry-standard Go libraries for CLI development, including
github.com/spf13/cobraandgithub.com/spf13/viper. These are widely recognized and reputable open-source projects. - [INDIRECT_PROMPT_INJECTION]: The skill includes patterns for ingesting external data from environment variables, configuration files, and command-line flags. 1. Ingestion points: The skill utilizes
viper.ReadInConfig(),viper.AutomaticEnv(), and standard Cobra argument parsing. 2. Boundary markers: The template encourages validation logic withinPreRunEhooks and specific argument requirements likecobra.ExactArgs(1). 3. Capability inventory: The code demonstrates patterns for reading configuration from the file system and provides stubs for deployment logic. 4. Sanitization: It utilizes type-safe configuration accessors (e.g.,viper.GetInt) and struct unmarshaling to ensure data integrity.
Audit Metadata