The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing several tools from external GitHub repositories using the go install command, which fetches and compiles code from the network. These include github.com/mandiant/GoReSym (a repository associated with a well-known security company), github.com/goretk/redress (an unverifiable third-party organization), and github.com/go-delve/delve (the repository for the standard Go debugger). It also mentions a plugin from github.com/0xjiayu/go_parser and bloaty from github.com/google/bloaty (an organization recognized as a well-known service).
[REMOTE_CODE_EXECUTION]: The use of go install <url>@latest acts as a remote code execution mechanism because it downloads, compiles, and installs software from external sources at runtime.
[COMMAND_EXECUTION]: The skill provides shell commands for tool setup using system package managers (apt, dnf, pacman, brew, choco) and binary analysis tools (file, readelf, nm, strings). It also mentions running dlv attach and strace for dynamic analysis.
[INDIRECT_PROMPT_INJECTION]: This skill is designed to ingest and analyze untrusted Go binary files, which presents an attack surface for indirect injection.
Ingestion points: Untrusted binary samples (e.g., sample) are processed by multiple analysis tools in the workflow.
Boundary markers: The instructions explicitly state that dynamic analysis steps should follow sandbox protocols (referencing re-analyze/platform-tips).
Capability inventory: The skill provides instructions for static and dynamic analysis, including executing scripts within Ghidra/IDA and debugging processes.
Sanitization: No specific sanitization or filtering of tool output is described, although the sandbox recommendation acts as a primary safety mitigation.

re-go