pflow-golang-setup
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's reference templates facilitate the use of official GitHub Actions (such as actions/checkout and actions/setup-go) and industry-standard tools (like govulncheck) from trusted organizations and well-known services.- [INDIRECT_PROMPT_INJECTION]: The skill audits local project files, which constitutes a surface for indirect prompt injection if those files contain malicious instructions intended to influence the agent's auditing logic.
- Ingestion points: The scripts/setup-context.sh script reads metadata and content from local files including go.mod, .golangci.yml, and various task runner configurations.
- Boundary markers: The skill does not implement specific delimiters or instructions to ignore instructions embedded within the audited file content.
- Capability inventory: The agent is instructed to analyze project state and generate new configuration files or diffs based on the audited data.
- Sanitization: There is no evidence of specific sanitization, filtering, or validation applied to the content extracted from the project files during the audit phase.
Audit Metadata