The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a local Bash script (scripts/go-stack.sh) used to detect the project environment (Go version, dependencies, and configuration files). The script performs read-only operations using awk and grep on local files like go.mod to determine which reference materials are relevant. It also suggests running standard Go linting and testing tools (gofmt, go vet, golangci-lint) or project-defined tasks (make, task), which are routine development activities.
[DATA_EXPOSURE]: The skill analyzes local repository metadata (package names, versions, and tool configurations) to provide contextual coding advice. It does not access sensitive user files, credentials, or perform network operations to exfiltrate data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the project's go.mod file and file structure. However, it uses this information solely to select from a static set of internal reference markdown files (references/*.md) and provides instructions for standard Go coding practices. The risk of malicious data in go.mod influencing the agent in a harmful way is negligible as the ingestion is handled via a dedicated script with JSON escaping and the output is used to scope the agent's internal documentation lookups.

pflow-golang