protoc-plugin-engineering
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves the agent processing and generating code based on Protobuf descriptors (.proto files), representing a standard data ingestion surface for this domain.
- Ingestion points: The skill operates on .proto contracts and Go source files within the repository (SKILL.md).
- Boundary markers: No specific prompt delimiters are defined for the agent's context, but the skill mandates strict adherence to structural engineering guidelines to minimize variance.
- Capability inventory: The 'Local Quality Gate' executes shell commands including go, git, golangci-lint, and nilaway (SKILL.md).
- Sanitization: The skill explicitly mandates the use of strconv.Quote for all dynamic content in generated code to prevent injection attacks in downstream systems (references/plugin-output-rules.md).
- [SAFE]: The skill outlines a standard development workflow for Go-based Protobuf plugins. It includes a quality gate that utilizes well-known, legitimate developer tools such as go test, go vet, and golangci-lint. The instructions explicitly recommend security hardening measures, such as ensuring output determinism and preventing state leakage between files. No malicious patterns, such as data exfiltration, suspicious network calls, or obfuscation, were detected. The references to the go-sphere organization's infrastructure are consistent with legitimate vendor functionality.
Audit Metadata