The Agent Skills Directory

[METADATA_POISONING]: The skill's YAML frontmatter identifies the author as samber and the homepage as https://github.com/samber/cc-skills-golang. This directly contradicts the authoritative author identification provided by the platform (marcioaltoe). Such discrepancies in metadata are deceptive and can lead to misjudgment of the skill's provenance and safety.
[EXTERNAL_DOWNLOADS]: The skill's instructions and reference documentation (specifically logging.md, metrics.md, and tracing.md) promote the installation and use of a wide variety of third-party Go packages from the github.com/samber organization. These include slog-zap, slog-logrus, slog-zerolog, slog-multi, slog-sampling, slog-formatter, slog-http, slog-gin, slog-echo, slog-fiber, slog-chi, slog-datadog, slog-sentry, slog-loki, slog-nats, slog-syslog, slog-fluentd, slog-slack, and oops. These packages do not originate from the official vendor (marcioaltoe) and are not from established trusted organizations or well-known services defined in the safety protocols. Encouraging the widespread adoption of unverified third-party dependencies for production observability constitutes a supply chain risk.
[INDIRECT_PROMPT_INJECTION]: The skill is configured to perform audits of existing codebases, which involves ingesting untrusted data that could contain malicious instructions.
Ingestion points: Uses Read, Glob, and Grep tools to ingest content from the current project environment.
Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore embedded instructions in the audited data.
Capability inventory: The skill has high-privilege capabilities including Write, Edit, and Bash(go:*) (allowing execution of Go compiler and toolchain commands).
Sanitization: There is no evidence of sanitization or validation for the code content being processed.
This combination of untrusted data ingestion and powerful execution tools creates a vulnerability where the agent could be manipulated by comments or code patterns in the files it is auditing.

golang-observability