golang-spf13-cobra
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is configured to interact with Go source code files, which introduces a theoretical attack surface where the agent could follow instructions embedded in comments or string literals within project files.
- Ingestion points: The skill access project files through the glob pattern specified in the paths field of SKILL.md.
- Boundary markers: The instructions do not define specific delimiters or warnings to differentiate between code and embedded natural language instructions.
- Capability inventory: The skill is granted access to powerful tools including Bash, Write, and Edit as specified in the allowed-tools field of SKILL.md.
- Sanitization: No explicit content validation or sanitization is required by the skill before processing project data.
- [EXTERNAL_DOWNLOADS]: The skill references the installation and use of the cobra-cli scaffolding tool and documentation generators from the official spf13 GitHub organization. These are standard, well-known engineering tools for Go development.
Audit Metadata