coding-guidance-go-tui
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official source repositories and package documentation for the Charmbracelet suite (Bubble Tea, Bubbles, Lip Gloss, and Huh) hosted on GitHub and Go's official package registry (pkg.go.dev). These references point to established, well-known software projects.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building applications that process external data from files or network APIs and display them in a terminal UI.
- Ingestion points: External data loaded via commands, user keystrokes, and window resize events documented in
SKILL.mdandreferences/charmbracelet-patterns.md. - Boundary markers: The skill encourages strict state modeling and routing messages through an Elm-style update loop, creating logical boundaries between input and state.
- Capability inventory: The instructions acknowledge the use of subprocesses, filesystem access, and network operations, directing the user to return these as typed
tea.Cmdobjects rather than executing them directly in the UI loop. - Sanitization: The skill recommends using cell-aware helpers and ANSI-aware rendering libraries (Lip Gloss) to handle layout, which helps prevent terminal-based injection or display corruption from malformed data.
Audit Metadata