golang-development
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and execute code within a user's repository, which represents a surface for indirect prompt injection if the repository content contains instructions intended to influence the agent. Ingestion points: The agent reads source code, go.mod files, and repository documentation to perform its tasks (SKILL.md, references/detailed-guide.md). Boundary markers: The instructions do not include specific delimiters or warnings to ignore instructions embedded within the codebase being analyzed. Capability inventory: The skill uses tools like go test, go vet, gofmt, and docker build, which involve processing or executing code from the repository (SKILL.md, references/detailed-guide.md). Sanitization: The skill does not implement sanitization or filtering of the content read from the codebase.
- [EXTERNAL_DOWNLOADS]: The guide includes examples and instructions for downloading various third-party libraries and utilities from public repositories. Evidence: Mentions fetching packages such as gin-gonic/gin, gorm, cobra, viper, and zap, as well as installing tools like golangci-lint and migrate (references/detailed-guide.md).
- [COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands to manage, test, and build Go projects. Evidence: Commands include go test ./..., go mod tidy, gofmt -w, and docker build (SKILL.md, references/detailed-guide.md).
Audit Metadata