golang-security
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Go source code files (**/*.go) to perform security audits. Malicious instructions embedded within comments or strings in the analyzed code could potentially influence the agent's behavior.\n
- Ingestion points: Go source files matched by the **/*.go pattern defined in the skill manifest.\n
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore potentially malicious instructions embedded in the target source code.\n
- Capability inventory: The skill enables access to powerful tools including Bash(go:), Bash(git:), Bash(govulncheck:*), Write, Edit, WebFetch, and WebSearch, which could be abused if an injection is successful.\n
- Sanitization: The instructions lack specific guidance for sanitizing or escaping the content of analyzed files before they are processed by the agent.\n- [EXTERNAL_DOWNLOADS]: The skill automates the installation of recognized Go security auditing tools.\n
- Evidence: The skill configuration installs govulncheck from golang.org/x/vuln/cmd/govulncheck@latest and provides instructions for fetching gosec from github.com/securego/gosec/v2/cmd/gosec@latest.
Audit Metadata