golang-pkg-go-dev
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of a third-party tool from an external repository using
go install github.com/samber/godig/cmd/godig@latestand also references a hosted MCP server athttps://godig.samber.dev/mcp. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display documentation, synopses, and README files for any public Go package from
pkg.go.dev, which are untrusted external sources that could contain malicious instructions. - Ingestion points: Documentation and package data retrieved via the
godigCLI/MCP server as described inSKILL.md. - Boundary markers: The skill recommends using the
-o mdflag for chat rendering but does not provide specific instructions or delimiters to isolate the agent from potentially adversarial instructions embedded in the external documentation. - Capability inventory: The skill environment permits the use of powerful tools including
Bash,Write, andEdit, creating a potential impact if the agent follows instructions found in external package docs. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from
pkg.go.devbefore it is processed by the agent.
Audit Metadata