go-cobra-applications
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the generation of Go code based on user-provided CLI specifications, which creates an attack surface where untrusted data could influence agent actions. This risk is addressed by explicit rules (Rule 16 and 17) requiring semantic validation of inputs and the protection of sensitive data. * Ingestion points: User-provided command hierarchies and workflow requirements (SKILL.md, workflows/build-cobra-command-tree.md). * Boundary markers: Not present. * Capability inventory: Writing Go source files and executing shell tests. * Sanitization: Rules mandate validation of port ranges, timeouts, and paths (references/cobra-applications/rules.md).
- [EXTERNAL_DOWNLOADS]: The skill instructions include verification of implementation details against well-known technology sources, specifically the official documentation for the Cobra project (cobra.dev) and the Viper configuration library on GitHub (github.com/spf13/viper). These references are documented neutrally as authoritative project resources for API verification.
Audit Metadata