The Agent Skills Directory

[METADATA_POISONING]: The skill consistently references non-existent versions of software and provides invalid documentation links.
References Go version 1.26 (latest stable is 1.23) and golangci-lint version 2 throughout the skill and its reference files.
Provides multiple links to go.dev/doc/go1.26 and golangci-lint.run/docs/product/migration-guide/, which do not exist for the cited versions.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted codebase files and tool outputs, which could be manipulated to influence agent behavior.
Ingestion points: Reads and parses go.mod, go.work, .golangci.yml, and processes output from tools like govulncheck and golangci-lint (as described in SKILL.md and references/templates/ci-workflow.md).
Capability inventory: The skill has the ability to execute go (test, fix, mod, work, vet, install, run), golangci-lint, and jq via shell commands.
Boundary markers: There are no instructions to use delimiters or ignore embedded instructions within the ingested codebase files.
Sanitization: No evidence of sanitization or validation for tool outputs or file content before processing by the agent.
[EXTERNAL_DOWNLOADS]: The skill fetches Go-specific development tooling from official sources.
Downloads and executes govulncheck and goimports from the golang.org/x/ official Go project repositories (SKILL.md, references/govulncheck.md).
[COMMAND_EXECUTION]: The skill executes various shell commands to perform analysis and codebase transformations.
Runs go install, go run, go test, go fix, and golangci-lint on the local filesystem as part of the quality gate and modernization workflows.

go-tooling-security