protoc-plugin-engineering
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a local quality gate that involves executing standard Go development tools via the shell, such as
gofmt,go mod,go test,go vet,golangci-lint, andnilaway. These commands are used to ensure code consistency and correctness within the local development environment. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external data in the form of Protocol Buffer definitions and descriptor sets which drive the code generation process.
- Ingestion points: Untrusted data enters the context through
.protofiles and descriptor sets provided in thetestdata/directory and via theprotogenplugin interface (documented inreferences/plugin-testing.md). - Boundary markers: The skill utilizes the standard
protogenlibrary which enforces the structured Protocol Buffer schema on all inputs, providing inherent structural boundaries. - Capability inventory: The system performs local compilation and test execution (
go test) on the generated output to verify functional integrity as described in the quality gate. - Sanitization: The skill explicitly requires the use of
strconv.Quoteinreferences/plugin-conventions.mdfor any dynamic content or user-supplied strings (such as comments or option values) that are interpolated into the generated Go source code, mitigating potential code injection into the final output.
Audit Metadata