go-concurrency
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard Go toolchain commands, specifically
go test -race ./...andgo build, to validate code implementation and detect data races. These are legitimate development operations provided by the official Go environment. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to review and interact with existing Go codebases, creating a potential attack surface for indirect prompt injection.
- Ingestion points: The agent is instructed to use the
explore-codebasetool to map and read existing goroutine, channel, and context usage from the local repository. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when reading or processing the codebase content.
- Capability inventory: The agent has the capability to execute shell commands via the Go toolchain (
go test,go build) and perform documentation research using external tools (Context7,Exa). - Sanitization: There are no explicit instructions to sanitize or validate the content of the files read from the codebase before they are processed by the agent.
Audit Metadata