The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing and using several third-party Go tools from individual GitHub repositories for dependency auditing and binary size analysis.
Evidence: The instructions mention psampaz/go-mod-outdated, jondot/goweight, Zxilly/go-size-analyzer, and samber/go-mod-graph across SKILL.md and the auditing reference.
Context: These tools are common in the Go ecosystem for managing technical debt and binary size. The risk is mitigated by a mandatory user confirmation step before new packages are installed.
[INDIRECT_PROMPT_INJECTION]: The skill processes project-specific metadata and external tool outputs which could contain untrusted data from third-party modules.
Ingestion points: The agent reads go.mod and go.sum files and interprets the output from go list and go mod graph commands.
Boundary markers: The skill instructions explicitly direct the agent to ask the user for confirmation before pulling in any package the project does not yet have.
Capability inventory: The agent has access to go, git, and govulncheck via the shell environment as specified in the skill configuration.
Sanitization: No specific filtering or sanitization of the content from dependency files or command output is performed before the agent processes it.

golang-dependency-management