go-api-structure
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a reference guide for building robust Go services, focusing on architectural patterns that enhance security. It provides explicit instructions on defensive programming, such as capping request body sizes, preventing internal error leakage to clients, and utilizing vetted password hashing libraries.
- [EXTERNAL_DOWNLOADS]: The example code utilizes standard Go dependencies through a go.mod file, referencing reputable packages like modernc.org/sqlite and github.com/google/uuid. These are standard libraries in the Go ecosystem and exhibit no suspicious characteristics.
- [COMMAND_EXECUTION]: The documentation provides instructions for standard Go development tools such as go test, golangci-lint, and govulncheck. These commands are typical for Go projects and are used within a benign development context.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for handling external HTTP data, which presents a potential injection surface. 1. Ingestion points: example/internal/httpapi/encoding.go (via JSON decoding). 2. Boundary markers: Present; the implementation uses http.MaxBytesReader and DisallowUnknownFields to enforce structural boundaries. 3. Capability inventory: Database operations in internal/sqlstore and concurrent worker pools in internal/jobs. 4. Sanitization: Present; handlers include specific validation closures to verify input presence and shape before processing.
Audit Metadata