golang-pro
Fail
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The YAML frontmatter in SKILL.md contains an author URL (https://github.com/Jeffallan) and documentation link (https://jeffallan.github.io/claude-skills/skills/language/golang-pro/) that have been flagged as malicious by reputation scanners. The file SKILL.md itself is flagged for known malware characteristics.- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install external dependencies and tools, such as
golangci-lintand various packages viago getandgo mod download, from external sources that are not strictly limited to the platform's trusted vendor list.- [REMOTE_CODE_EXECUTION]: Instructions in references/project-structure.md direct the installation of external tools (go install github.com/golang/mock/mockgen@latest) and the execution of code generation (go generate ./...), which can execute arbitrary code during the build process if the source is compromised.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided Go source code. It lacks explicit boundary markers or 'ignore' instructions for embedded data, creating an attack surface where malicious code comments or identifiers could influence the agent's behavior while it has access to capabilities like runninggo test -race,go vet, andgolangci-lint.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata