golangci-lint-strict
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a
.golangci.ymlconfiguration file from the public GitHub repositorypowerman/golangci-lint-strictusingcurlorwget.- [COMMAND_EXECUTION]: Executes a bundled shell scriptassets/install-strict-config.shto automate the download and verification process. The script includes logic to prevent accidental overwriting of existing configuration files and relies on a hardcoded commit SHA for reproducibility.- [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration data from a remote repository, which presents a surface for potential instruction injection if the source were compromised. - Ingestion points: The
assets/install-strict-config.shscript downloads the configuration file viacurlorwgetfrom a versioned path. - Boundary markers: The script validates the downloaded file by checking for a specific
# Origin:header matching the expected repository and version in the first 5 lines. - Capability inventory: Uses
bash,curl/wget, andmvfor file management; executesgolangci-lint runto process the downloaded configuration. - Sanitization: Implements a strict header verification check to ensure the file source matches the expected upstream metadata before moving the file to its final destination.
Audit Metadata