The Agent Skills Directory

[METADATA_POISONING]: There is a significant discrepancy in the declared author identity. The SKILL.md frontmatter and associated documentation attribute the content to 'samber' and link to that developer's official repositories. However, the system-provided author context identifies the creator as 'marcioaltoe'. This contradiction in provenance metadata can lead to misjudgment regarding the skill's safety and authenticity.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze Go source code and benchmarks for performance reviews. This workflow creates an attack surface for indirect prompt injection if the agent processes malicious instructions embedded in code comments, strings, or data processed during a review session.
Ingestion points: The skill reads user project files using Read, Glob, and Grep tools.
Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from executing instructions found within the analyzed source code.
Capability inventory: The agent is granted Write, Edit, and Bash capabilities, which could be abused if the agent's logic is influenced by malicious payloads in user code.
Sanitization: The skill does not implement sanitization or filtering for the content of the files being analyzed.
[EXTERNAL_DOWNLOADS]: The skill references and installs several external tools and libraries essential for Go performance engineering.
Evidence: The skill performs go install golang.org/x/perf/cmd/benchstat@latest and recommends libraries such as go-singleflightx, golang-lru, go-freelru, and pyroscope-go.
Context: These downloads target well-known organizations (e.g., Google/Golang, Hashicorp, Elastic, Grafana, Uber) and reputable community libraries, appearing to be standard development dependencies.
[COMMAND_EXECUTION]: The skill utilizes multiple shell-based tools to perform its tasks.
Evidence: The allowed tools and instructions include the use of go test, go build, benchstat, fieldalignment, staticcheck, fgprof, and curl (to fetch pprof profiles from localhost).

golang-performance