go-sphere-makefiles
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external repository configuration files, creating a potential surface for indirect prompt injection. 1. Ingestion points: SKILL.md instructions direct the agent to read Makefiles, CI workflows, and Go module files from the target repository. 2. Boundary markers: The skill includes explicit instructions stating 'Do not commit, push, tag, publish, or rerun remote workflows unless the user asks.' 3. Capability inventory: The agent is authorized to modify Makefiles and execute build/test/lint commands via the repository's Make interface. 4. Sanitization: The skill requires the agent to report all commands run and tasks the user with verifying changes through diff reviews and clean-snapshot testing.
- [EXTERNAL_DOWNLOADS]: Makefile templates provided in references/makefile-patterns.md include a 'deps-update' target that uses 'go get -u' to download updates for external Go dependencies. This behavior is documented and central to the skill's purpose of standardizing dependency management.
- [COMMAND_EXECUTION]: The skill defines a contract for executing development commands (test, lint, check, build) through Make. It emphasizes the use of overridable tool variables and explicit target definitions to ensure predictable and reviewable execution environments.
Audit Metadata