go-backend-dev
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data through Go HTTP handlers and project file reading, combined with tool access for code modification and shell execution. This profile introduces a surface for indirect prompt injection. 1. Ingestion points: SKILL.md describes handling http.Request bodies and using smart_read to analyze existing code. 2. Boundary markers: No specific delimiters or warnings for embedded instructions are provided in the skill text. 3. Capability inventory: The agent is authorized to write files (smart_edit), install dependencies (add_dependency), and execute build/test commands (go build, verify_tests). 4. Sanitization: The logic relies on standard Go library decoding (encoding/json), which ensures basic type safety but does not filter for prompt instructions.
- [SAFE]: The skill follows secure software development practices, including dependency verification, manual behavior testing, and proper documentation updates. All recommended patterns are idiomatic to the Go language.
Audit Metadata