go-sphere-makefiles

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and analyze external repository files such as Makefiles, CI workflows, and Go module files to guide its standardization and verification tasks. This ingestion surface allows for potential indirect prompt injection if those files contain malicious instructions intended to manipulate the agent's logic.
  • Ingestion points: SKILL.md instructions specify reading repository documentation, Makefiles, go.mod, go.work, and CI configurations.
  • Boundary markers: The skill advises manual inspection before editing but lacks formal boundary delimiters for processing raw data.
  • Capability inventory: The skill performs file updates and executes shell commands via make and go tools.
  • Sanitization: No explicit sanitization or escaping of external repository content is defined.
  • [COMMAND_EXECUTION]: The skill involves the execution of various build, linting, and verification commands to validate Makefile changes.
  • Evidence: The Verification section in SKILL.md requires running changed common targets and using tools like actionlint to validate workflows.
  • [DYNAMIC_EXECUTION]: The skill generates Makefiles and CI workflow configurations based on provided templates, which are subsequently executed as part of the verification process.
  • Evidence: references/makefile-patterns.md provides templates for Makefiles and GitHub Actions workflows that the agent is expected to implement and run to confirm they work correctly.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 09:59 AM