backend-go-observability
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes 'Audit' and 'Review' modes designed to analyze existing codebases. This process creates a surface for indirect prompt injection, where malicious instructions could be embedded in code files or comments to influence the agent's behavior. The agent's ability to edit files and execute developer tools like Git and the Go compiler increases the potential impact of this vector.
- Ingestion points: The skill reads project source files using
Read,Glob, andGreptools during audits. - Boundary markers: There are no explicit instructions for the agent to use specific delimiters or protective wrappers when processing code content.
- Capability inventory: The agent has access to
Write,Edit, andBash(restricted togo,git, andgolangci-lint) capabilities. - Sanitization: No explicit routines for sanitizing or escaping ingested code content are documented.
- [EXTERNAL_DOWNLOADS]: The skill references several well-known observability libraries and services, including Prometheus, OpenTelemetry, PostHog, Segment, and Pyroscope, as well as an internal team library.
- Source: References industry-standard domains and repositories for observability tooling, along with an internal GitLab instance for team-specific packages.
Audit Metadata