go-oss-maintainer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements standard, high-quality development workflows for Go projects, including template-based configuration for common repository files such as licenses, READMEs, and ignore files.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch the latest version information for
golangci-lintfrom the official GitHub API. This is a legitimate and neutral interaction with a well-known service to ensure CI/CD pipelines use up-to-date tooling. - [COMMAND_EXECUTION]: The skill utilizes standard Go CLI tools (e.g.,
go version,go mod tidy,go tool golangci-lint) to manage project dependencies and verify code quality. These operations are intended for use with project-local tools in a development environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data by detecting the local Go version and merging baseline patterns into existing
.gitignorefiles. While this creates a potential surface for indirect injection if project files were maliciously crafted, the behavior is consistent with the skill's primary purpose as a repository maintenance tool. - Ingestion points: Reads output from
go versionand the content of existing.gitignorefiles during the initialization workflow. - Boundary markers: None explicitly defined for the template merging process.
- Capability inventory: Local file system write access, Go CLI execution, and network access to the GitHub API.
- Sanitization: None explicitly implemented for the merging of baseline ignore patterns.
Audit Metadata