go-interfaces
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill includes a shell script (scripts/check-interface-compliance.sh) that compiles an embedded Go source file (scripts/check-interface-compliance.go) at runtime using the go build command. The resulting binary is cached and then executed via the Bash tool. This runtime compilation of local source code is a dynamic execution pattern.
- [INDIRECT_PROMPT_INJECTION]: The compliance checker parses and analyzes user-provided Go source files, creating an attack surface where malicious code could influence agent behavior.
- Ingestion points: The findGoFiles and analyzePackage functions in scripts/check-interface-compliance.go walk the file system and read Go files into the analysis context.
- Boundary markers: No delimiters or instructions are present to prevent the agent from potentially following instructions embedded within the analyzed Go files.
- Capability inventory: The skill is authorized to use the Bash tool to run the analysis script, which has access to the file system.
- Sanitization: The tool utilizes standard Go parsing libraries (go/parser) which validate syntax but do not sanitize the content for potential injection or malicious patterns targeting the LLM.
Audit Metadata