golang-dependency-management
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a strong safety rule requiring AI agents to ask for user confirmation before adding new dependencies via
go get. This prevents the automated introduction of potentially unvetted or malicious packages. - [SAFE]: The instructions emphasize critical security practices, including the necessity of committing
go.sumfiles to prevent supply-chain tampering and the use ofgovulncheckto detect reachable vulnerabilities in the dependency tree. - [SAFE]: Remote resources and package recommendations target trusted organizations such as the Go team (
golang.org/x) and Google, or well-known community repositories. These are documented neutrally as standard project tooling. - [SAFE]: The
allowed-toolsconfiguration uses command-specific restrictions (e.g.,Bash(go:*)), adhering to the principle of least privilege for the agent's execution environment.
Audit Metadata