golang-swagger
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
swagcommand-line utility from the official GitHub repository using the standard Go toolchain. - Evidence:
go install github.com/swaggo/swag/cmd/swag@latestin themetadata.openclaw.installsection. - Context: This is the recognized installation method for the industry-standard Swagger generator for Go.
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves parsing annotations within Go source code files, which presents a surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: Go source files (
**/*.go) containing doc-comments with@annotations. - Boundary markers: None explicitly defined in the instructions for the tool's parsing phase.
- Capability inventory: The skill uses
Bash(swag:*)to execute the generation tool and possessesWritecapabilities to create or update thedocs/directory. - Sanitization: Processing relies on the
swagutility's parser; no additional sanitization of comment content is specified in the skill body.
Audit Metadata