golang-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to analyze and review Go code provided in pull requests or files, which are untrusted external data sources. This creates a surface for indirect prompt injection where malicious instructions could be embedded within code comments or logic to influence the agent's review behavior.
- Ingestion points: The review workflow described in
SKILL.mdinvolves reading and evaluating code snippets or full PRs provided in the agent's execution context. - Boundary markers: The skill instructions do not mandate the use of delimiters or specific prompts to distinguish the code being reviewed from the agent's own instructional logic.
- Capability inventory: The skill focuses on generating text-based feedback. No scripts or instructions within the skill files invoke dangerous capabilities such as direct shell execution, file-system modification, or unauthorized network access.
- Sanitization: There are no instructions or mechanisms provided to sanitize or filter the content of the analyzed code before it is interpreted by the agent.
Audit Metadata