golangci-lint-strict

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a .golangci.yml configuration file from the public GitHub repository powerman/golangci-lint-strict using curl or wget.- [COMMAND_EXECUTION]: Executes a bundled shell script assets/install-strict-config.sh to automate the download and verification process. The script includes logic to prevent accidental overwriting of existing configuration files and relies on a hardcoded commit SHA for reproducibility.- [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration data from a remote repository, which presents a surface for potential instruction injection if the source were compromised.
  • Ingestion points: The assets/install-strict-config.sh script downloads the configuration file via curl or wget from a versioned path.
  • Boundary markers: The script validates the downloaded file by checking for a specific # Origin: header matching the expected repository and version in the first 5 lines.
  • Capability inventory: Uses bash, curl/wget, and mv for file management; executes golangci-lint run to process the downloaded configuration.
  • Sanitization: Implements a strict header verification check to ensure the file source matches the expected upstream metadata before moving the file to its final destination.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:39 AM