godoc
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted source code and repository instructions to generate documentation.
- Ingestion points: The skill reads exported declarations, implementations, tests, and existing documentation from the Go codebase, along with repository-specific instructions (SKILL.md, Steps 1 and 2).
- Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands embedded within the processed source code.
- Capability inventory: The agent can write to files, execute
go docto check output, rungo testto verify examples, and use repository-defined formatting tools (SKILL.md, Step 7). - Sanitization: No specific sanitization or escaping of external content is mentioned before it is included in documentation strings.
- [COMMAND_EXECUTION]: The skill utilizes local command-line tools to perform verification and formatting tasks.
- Evidence: The skill directs the agent to execute
go docfor inspection andgo testfor verification, along with repository-specific formatting tools (SKILL.md, Step 7; references/examples.md, 'Validation'). - [DYNAMIC_EXECUTION]: The skill involves the execution of code within the package being documented through the testing framework.
- Evidence: The skill requires running Example tests and package tests to verify documentation accuracy and recipe validity (SKILL.md, Step 7; references/examples.md, 'Validation').
Audit Metadata