The Agent Skills Directory

[METADATA_POISONING]: The skill contains deceptive technical information throughout its documentation and configuration fields. Specifically, the frontmatter in SKILL.md and content in references/goroutine-leaks.md claim support for Go version 1.26 and reference a non-existent goroutineleakprofile runtime experiment. It also cites a hallucinated documentation URL (https://go.dev/doc/go1.26). This misinformation may lead developers or agents to attempt to use non-functional features or adopt incorrect concurrency assumptions based on the purported future version of the language.
[PROMPT_INJECTION]: The Agent Workflow (MANDATORY) section in SKILL.md uses imperative language to force the agent to follow a specific sequence of actions, including spawning three sub-agents (fuse-ai-pilot:explore-codebase, fuse-ai-pilot:research-expert, and mcp__context7__query-docs). This attempts to override the agent's autonomous task planning by mandating external tool invocations as a prerequisite for any implementation.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where it processes external data without adequate safety boundaries.
Ingestion points: The FetchAll function template in references/templates/errgroup-patterns.md accepts a slice of URLs (urls []string) for processing.
Boundary markers: There are no markers or instructions provided to the agent to treat this input as potentially untrusted or to ignore embedded instructions.
Capability inventory: The skill uses the http package (specifically http.DefaultClient.Do) to perform network requests and errgroup for concurrent execution, providing a mechanism for fanned-out network operations.
Sanitization: The provided code templates lack any input validation, URL sanitization, or filtering, which could allow for Server-Side Request Forgery (SSRF) if the agent is directed to process untrusted lists of URLs.

go-concurrency