protoc-plugin-engineering

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill defines a local quality gate that involves executing standard Go development tools via the shell, such as gofmt, go mod, go test, go vet, golangci-lint, and nilaway. These commands are used to ensure code consistency and correctness within the local development environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external data in the form of Protocol Buffer definitions and descriptor sets which drive the code generation process.
  • Ingestion points: Untrusted data enters the context through .proto files and descriptor sets provided in the testdata/ directory and via the protogen plugin interface (documented in references/plugin-testing.md).
  • Boundary markers: The skill utilizes the standard protogen library which enforces the structured Protocol Buffer schema on all inputs, providing inherent structural boundaries.
  • Capability inventory: The system performs local compilation and test execution (go test) on the generated output to verify functional integrity as described in the quality gate.
  • Sanitization: The skill explicitly requires the use of strconv.Quote in references/plugin-conventions.md for any dynamic content or user-supplied strings (such as comments or option values) that are interpolated into the generated Go source code, mitigating potential code injection into the final output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 03:04 PM
Security Audit — agent-trust-hub — protoc-plugin-engineering