backend-go-grpc

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external project data, such as protocol buffer definitions and Go source code, creating a potential surface for indirect prompt injection if those files contain malicious instructions.
  • Ingestion points: The agent is instructed to use Read, Glob, and Grep tools to ingest content from .proto and .go files within the project workspace, as seen in SKILL.md and references/protoc-reference.md.
  • Boundary markers: The skill does not explicitly provide or require the use of delimiters or specific 'ignore' instructions when the agent reads and processes these external files.
  • Capability inventory: The agent has extensive capabilities including file modification (Write, Edit), shell command execution via Bash (used for code generation and testing), and the ability to fetch documentation via WebFetch.
  • Sanitization: The instructions do not define any sanitization, validation, or filtering of the ingested file content before it is utilized to generate new code or influence agent logic.
  • [DYNAMIC_EXECUTION]: The skill facilitates the generation of executable Go code from Protobuf definitions using standard tools like protoc and buf (referenced in references/protoc-reference.md). This generated code is integrated into the project's build and runtime environment, which is the intended purpose of the skill.
  • [EXTERNAL_DOWNLOADS]: The skill references the buf tool, which is configured to fetch and use remote plugins from buf.build (a well-known service in the Protobuf ecosystem) during the buf generate process.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 04:29 AM