The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading and processing untrusted repository data, creating a surface where malicious instructions embedded in the codebase could influence agent behavior.
Ingestion points: The skill ingests go.mod, go.work, .golangci.yml, and .go source files from the target repository for analysis and configuration tasks.
Boundary markers: No explicit instructions or delimiters are provided to the agent to treat embedded strings in these files as data rather than instructions.
Capability inventory: The skill executes several powerful CLI tools, including go fix, go vet, golangci-lint, and govulncheck, which operate on the ingested files.
Sanitization: No sanitization or validation of the content within the repository files is performed before processing.
[EXTERNAL_DOWNLOADS]: The skill manages the installation and usage of external tools from trusted sources.
Evidence: The skill fetches the govulncheck and goimports tools directly from golang.org (the official Go language domain) using go install and go run commands.
Evidence: The provided CI templates utilize official GitHub Actions from the actions (GitHub) and golangci organizations.
[COMMAND_EXECUTION]: The skill relies on shell command execution to perform its intended functions.
Evidence: Instructions include running go fix ./... for code modernization, govulncheck ./... for vulnerability scanning, and golangci-lint run for static analysis.

go-tooling-security