go-documentation
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes Go source files to generate or improve documentation, which presents an attack surface where instructions embedded within comments or code could influence the agent's actions.\n
- Ingestion points: Reads and analyzes project source files (.go files) through tools like Read, Glob, and Grep.\n
- Boundary markers: The instructions do not define markers to separate untrusted code content from agent instructions.\n
- Capability inventory: The skill allows file modification (Edit, Write) and command execution via the Go toolchain (Bash(go:*)).\n
- Sanitization: There is no evidence of sanitization or validation of the input code before processing.\n- [EXTERNAL_DOWNLOADS]: Fetches the pkgsite utility from the official Go language repository (golang.org/x/pkgsite) as part of the documentation verification process.\n- [REMOTE_CODE_EXECUTION]: Runs the pkgsite tool downloaded from the official Go domain to provide a local documentation preview.\n- [COMMAND_EXECUTION]: Employs the Go toolchain (go vet, go test, go doc) and the gofmt formatter via shell commands to verify and normalize documentation.
Audit Metadata