backend-go-grpc
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external project data, such as protocol buffer definitions and Go source code, creating a potential surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: The agent is instructed to use
Read,Glob, andGreptools to ingest content from.protoand.gofiles within the project workspace, as seen inSKILL.mdandreferences/protoc-reference.md. - Boundary markers: The skill does not explicitly provide or require the use of delimiters or specific 'ignore' instructions when the agent reads and processes these external files.
- Capability inventory: The agent has extensive capabilities including file modification (
Write,Edit), shell command execution viaBash(used for code generation and testing), and the ability to fetch documentation viaWebFetch. - Sanitization: The instructions do not define any sanitization, validation, or filtering of the ingested file content before it is utilized to generate new code or influence agent logic.
- [DYNAMIC_EXECUTION]: The skill facilitates the generation of executable Go code from Protobuf definitions using standard tools like
protocandbuf(referenced inreferences/protoc-reference.md). This generated code is integrated into the project's build and runtime environment, which is the intended purpose of the skill. - [EXTERNAL_DOWNLOADS]: The skill references the
buftool, which is configured to fetch and use remote plugins frombuf.build(a well-known service in the Protobuf ecosystem) during thebuf generateprocess.
Audit Metadata