cali-coding-go-standards
Fail
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill automates the download of a shell script from a remote GitHub repository (golangci-lint) and executes it by piping the output directly to the shell.- [COMMAND_EXECUTION]: The setup-hooks.sh script modifies the global agent hook configuration file (~/.pi/agent/hook/hooks.yaml) to inject automated commands that run during tool events such as build and commit.- [COMMAND_EXECUTION]: The skill configures local git hooks by creating executable scripts in the .githooks directory and modifying the Git configuration to trigger them automatically.- [COMMAND_EXECUTION]: The skill automates the installation of multiple Go utilities using the go install command, including the vendor-provided datastar-lint tool and official tools like govulncheck.- [EXTERNAL_DOWNLOADS]: The generated CI workflow configuration fetches external GitHub Actions and downloads package dependencies from remote registries.- [PROMPT_INJECTION]: The skill processes untrusted Go source code and provides the agent with file-writing and command-execution capabilities without explicit sanitization or boundary markers, creating a surface for indirect prompt injection.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata