The Agent Skills Directory

[SAFE]: The skill implements strong security defaults by mandating that the AI agent MUST ask the user for confirmation before running go get to add new dependencies. This prevents the silent addition of unvetted or malicious packages.
[EXTERNAL_DOWNLOADS]: The skill references several external Go tools for auditing and visualization, including govulncheck (official Go tool), golangci-lint, go-mod-outdated, and goweight. These are standard, well-known utilities within the Go ecosystem. The downloads are handled via standard go get or go install commands.
[REMOTE_CODE_EXECUTION]: While the skill installs and executes CLI tools, it utilizes Go's built-in tool management system (go tool) and explicitly restricts execution to tools defined in the project's environment. The use of go 1.24+ tool directives is recommended as a modern, secure way to pin and run these utilities.
[DATA_EXFILTRATION]: No network exfiltration patterns were detected. The network activity is limited to standard Go module proxy operations and fetching configuration for Dependabot/Renovate, which are established industry practices.
[PROMPT_INJECTION]: The skill does not contain any instructions that attempt to bypass AI safety filters or override system constraints. Instead, it provides clear persona-based rules that enhance the agent's cautiousness regarding external dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill ingests local configuration files like go.mod and go.sum. While these are external inputs to the agent, the risk is minimal as the skill instructions emphasize integrity verification and manual review. Severity is assessed as SAFE given the context of standard development workflows.

golang-dependency-management