using-go-tool-directive

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md explicitly instructs fetching and running external Go modules (e.g., "go get -tool github.com/...", "go tool golangci-lint run") which pulls and executes code from public repositories (GitHub, golang.org, honnef.co, etc.), exposing the agent to untrusted third-party content whose outputs or behavior could influence subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime commands such as "go get -tool github.com/golangci/golangci-lint/cmd/golangci-lint" (and similar import paths like golang.org/x/tools/cmd/stringer, honnef.co/go/tools/cmd/staticcheck) which fetch remote Go modules that are then executed via "go tool" or installed and run locally, so the external URLs are runtime dependencies that cause remote code to be executed.