go-oss-maintainer

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements standard, high-quality development workflows for Go projects, including template-based configuration for common repository files such as licenses, READMEs, and ignore files.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the latest version information for golangci-lint from the official GitHub API. This is a legitimate and neutral interaction with a well-known service to ensure CI/CD pipelines use up-to-date tooling.
  • [COMMAND_EXECUTION]: The skill utilizes standard Go CLI tools (e.g., go version, go mod tidy, go tool golangci-lint) to manage project dependencies and verify code quality. These operations are intended for use with project-local tools in a development environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data by detecting the local Go version and merging baseline patterns into existing .gitignore files. While this creates a potential surface for indirect injection if project files were maliciously crafted, the behavior is consistent with the skill's primary purpose as a repository maintenance tool.
  • Ingestion points: Reads output from go version and the content of existing .gitignore files during the initialization workflow.
  • Boundary markers: None explicitly defined for the template merging process.
  • Capability inventory: Local file system write access, Go CLI execution, and network access to the GitHub API.
  • Sanitization: None explicitly implemented for the merging of baseline ignore patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:39 AM