golang-how-to

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The skill facilitates the setup of "always-load" instructions within project-specific AI agent configuration files, such as CLAUDE.md, AGENTS.md, and .cursor/rules/golang-skills.mdc. This mechanism ensures that the Go orchestrator is consistently active for project-related tasks, providing a structured development environment.
  • [COMMAND_EXECUTION]: The skill requires and executes standard Go development tools, including go, git, and the gopls language server. These tools are used for semantic code intelligence, navigation, diagnostics, and environment configuration.
  • [EXTERNAL_DOWNLOADS]: The skill manages the installation of the official Go language server (gopls) from golang.org/x/tools/gopls. This is a well-known and official source for Go development utilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project code and task context to dynamically route to relevant skills, which creates a surface where instructions embedded in project files could potentially influence agent actions.
  • Ingestion points: The skill reads task context, project source code, and existing configuration files to determine which skills to load (SKILL.md).
  • Boundary markers: No explicit delimiters or "ignore embedded instructions" warnings are specified for the processed data.
  • Capability inventory: The skill has capabilities to modify project configuration files, execute bash commands for Go development, and interact with language server protocols (references/project-config.md).
  • Sanitization: Employs idempotency checks (grep) and user confirmation tools before applying permanent changes to project configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:09 AM
Security Audit — agent-trust-hub — golang-how-to