golang-packages
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the pkgsite-cli utility from the official Go repository (golang.org/x/pkgsite).
- [COMMAND_EXECUTION]: Executes shell commands including pkgsite-cli, curl, jq, and xargs to perform package lookups and process JSON metadata.
- [INDIRECT_PROMPT_INJECTION]: Processes package and module metadata retrieved from pkg.go.dev.
- Ingestion points: External metadata is ingested via the pkgsite-cli tool and curl requests in SKILL.md and references/api.md.
- Boundary markers: No explicit delimiters or warnings are used to isolate external data.
- Capability inventory: Subprocess execution via go install, pkgsite-cli, curl, jq, and xargs.
- Sanitization: No input validation or sanitization of the fetched metadata is performed.
Audit Metadata