The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill audits external Go source code which could contain malicious instructions in comments. This occurs during code reviews and codebase audits. Ingestion points include Go source code files and pull request diffs read by the Read, Glob, and Grep tools. Boundary markers are absent; the orchestration instructions for sub-agents do not include guidance to ignore instructions embedded within the code being analyzed. Capability inventory includes spawning sub-agents via the Agent tool, restricted shell execution via Bash (limited to go, golangci-lint, and git), and file modifications via Write and Edit. Sanitization is absent as data ingested from the filesystem is processed directly by the agent without validation or escaping.\n- [EXTERNAL_DOWNLOADS]: The skill provides examples of interacting with a local profiling endpoint (http://localhost:6060/debug/pprof/goroutineleak). This utilizes standard diagnostic tools and does not involve fetching remote malicious payloads.\n- [SAFE]: The skill references well-known and trusted external resources, such as official Go documentation (go.dev) and established libraries like Uber's goleak. The author's library samber/ro is also referenced, which is consistent with the skill's identified vendor infrastructure.

golang-concurrency