go-cli-tui
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for building applications that execute subprocesses, including
go installfor distribution,sshfor tunneling and authentication handoffs, and package managers likebrewfor updates. The guidance emphasizes using structured argument calls over shell concatenation to prevent injection. - [EXTERNAL_DOWNLOADS]: Detailed guidance in
self-update.mddescribes how to implement self-update mechanisms that download binaries or source code. The instructions explicitly mandate security controls such as checksum verification, executable identity validation, and atomic replacement to mitigate risks. - [PERSISTENCE]: The documentation for shell completions (
shell-completion.md) discusses writing to user configuration directories like~/.zfuncand updatingfpath. It specifically cautions against silently editing shell profile files like.bashrcor.zshrc, advocating for atomic replacement and user-controlled setup.
Audit Metadata