go-cli-builder
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to ingest and process data from untrusted external sources, including project files (go.mod, README.md), API documentation, WSDL files, and HAR logs as seen in SKILL.md and references/cli-quality-loop.md.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions specify the execution of build and verification commands (make build, ./bin/ --help) based on the analyzed project structure, creating a pathway where malicious content in source files could influence execution behavior.
- [INDIRECT_PROMPT_INJECTION]: The instructions lack explicit boundary markers or sanitization requirements for handling untrusted data during the analysis and development phases.
Audit Metadata