go-sphere-makefiles
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and analyze external repository files such as Makefiles, CI workflows, and Go module files to guide its standardization and verification tasks. This ingestion surface allows for potential indirect prompt injection if those files contain malicious instructions intended to manipulate the agent's logic.
- Ingestion points:
SKILL.mdinstructions specify reading repository documentation, Makefiles,go.mod,go.work, and CI configurations. - Boundary markers: The skill advises manual inspection before editing but lacks formal boundary delimiters for processing raw data.
- Capability inventory: The skill performs file updates and executes shell commands via
makeandgotools. - Sanitization: No explicit sanitization or escaping of external repository content is defined.
- [COMMAND_EXECUTION]: The skill involves the execution of various build, linting, and verification commands to validate Makefile changes.
- Evidence: The Verification section in
SKILL.mdrequires running changed common targets and using tools likeactionlintto validate workflows. - [DYNAMIC_EXECUTION]: The skill generates Makefiles and CI workflow configurations based on provided templates, which are subsequently executed as part of the verification process.
- Evidence:
references/makefile-patterns.mdprovides templates for Makefiles and GitHub Actions workflows that the agent is expected to implement and run to confirm they work correctly.
Audit Metadata