golang-swagger

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the swag command-line utility from the official GitHub repository using the standard Go toolchain.
  • Evidence: go install github.com/swaggo/swag/cmd/swag@latest in the metadata.openclaw.install section.
  • Context: This is the recognized installation method for the industry-standard Swagger generator for Go.
  • [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves parsing annotations within Go source code files, which presents a surface for indirect prompt injection if those files contain malicious instructions.
  • Ingestion points: Go source files (**/*.go) containing doc-comments with @ annotations.
  • Boundary markers: None explicitly defined in the instructions for the tool's parsing phase.
  • Capability inventory: The skill uses Bash(swag:*) to execute the generation tool and possesses Write capabilities to create or update the docs/ directory.
  • Sanitization: Processing relies on the swag utility's parser; no additional sanitization of comment content is specified in the skill body.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 05:09 AM
Security Audit — agent-trust-hub — golang-swagger