go-middleware
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting untrusted data from HTTP requests (headers, bodies) which represents an inherent attack surface for indirect prompt injection if processed by an LLM downstream.
- Ingestion points: Request headers (r.Header.Get) and JSON bodies (json.NewDecoder) are used in examples in SKILL.md and references/context-propagation.md.
- Boundary markers: The patterns include explicit guidance in references/error-handling-middleware.md to never leak internal error details or panic information to the client.
- Capability inventory: Code examples demonstrate logging to stdout via slog and making downstream network requests via http.DefaultClient.Do.
- Sanitization: The skill advocates for type-safe context keys to prevent data contamination and provides helper functions for secure metadata extraction.
Audit Metadata