golang-gin-auth
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes handlers and middleware that process untrusted data from network requests, forming an attack surface for indirect prompt injection, though it implements robust mitigations.\n
- Ingestion points: Authentication handlers and middleware ingest JSON request bodies, cookies, and Authorization headers.\n
- Boundary markers: Data is validated through Go struct tags and Gin's binding package.\n
- Capability inventory: The implementation performs network requests to identity providers and CAPTCHA services, and interacts with Redis for state and blacklisting.\n
- Sanitization: Credentials are hashed using bcrypt, and JWT parsing includes strict whitelisting of allowed signing methods.\n- [EXTERNAL_DOWNLOADS]: The skill references and interacts with trusted external services for security verification.\n
- Verifies CAPTCHA tokens via official Google reCAPTCHA and hCaptcha API endpoints.\n
- Fetches user profile data from GitHub and Google APIs during OAuth2 workflows.
Audit Metadata