higress-wasm-go-plugin
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions facilitate the download of Go dependencies from the author's official GitHub organization (
github.com/higress-group) and well-known open-source libraries (github.com/tidwall/gjson). These are standard requirements for the plugin development workflow. - [COMMAND_EXECUTION]: Provides standard shell commands for project initialization, binary compilation (
go build), and local environment orchestration (docker compose). These commands are intended for local development and testing purposes. - [DATA_EXFILTRATION]: The skill documents patterns for external service communication via HTTP and Redis clients. These capabilities are explicitly described as core features for implementing gateway logic such as external authentication or rate limiting. No unauthorized or suspicious exfiltration logic was observed.
- [PROMPT_INJECTION]: The skill facilitates the ingestion and processing of HTTP request/response data (headers and bodies). While this identifies an attack surface for indirect prompt injection, it is the primary intended functionality of a gateway plugin, and the templates follow standard implementation practices.
Audit Metadata