backend-go-database
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to utilize background agents to scan and grep the existing codebase for query patterns, naming conventions, and common errors (such as missing
rows.Close()). This functionality creates a surface area for indirect prompt injection, as the agent may ingest malicious instructions hidden in code comments or string literals within the repository being analyzed. - Ingestion points: Local codebase files (SKILL.md)
- Boundary markers: Absent; there are no explicit instructions for the sub-agent to distinguish between code and potential natural language instructions embedded within the files.
- Capability inventory: Edit, Write, and Bash (restricted to go, golangci-lint, and git).
- Sanitization: Absent; the skill does not specify any sanitization or validation of the content read from the codebase before it is processed by the agent.
Audit Metadata