The Agent Skills Directory

[SAFE]: The skill provides comprehensive instructions for building production-ready Go REST APIs, emphasizing security best practices such as implementing ReadHeaderTimeout, using MaxBytesReader to prevent large payload attacks, and following RFC 9457 for standardized error reporting to avoid internal data leakage.
[SAFE]: The allowed-tools configuration implements a restricted scope for shell commands (e.g., Bash(go:*), Bash(git:*)), which limits the agent's execution environment to necessary development tools and adheres to the principle of least privilege.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and modify Go source code (**/*.go), which represents a potential attack surface for indirect prompt injection if an attacker-controlled codebase contains malicious instructions.
Ingestion points: Relative file paths matching **/*.go processed via Read and Glob tools.
Boundary markers: The skill establishes a clear developer persona and rigid technical guidelines that serve as functional boundaries for expected agent behavior.
Capability inventory: The agent has capabilities to read, write, edit files, and execute specific Go-related bash commands.
Sanitization: The skill explicitly instructs the agent to perform input validation and normalization before processing data, which reduces the risk of malicious payload execution.

golang-rest