port-from-go
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and translate untrusted Go source code provided by users, creating a surface for indirect prompt injection.
- Ingestion points: Go source code and table-driven test data provided by the user in the agent's context (SKILL.md).
- Boundary markers: The instructions lack explicit markers or warnings to the agent to disregard instructions potentially embedded within the source code being analyzed.
- Capability inventory: The skill encourages running shell commands like 'cargo test' and 'go test' (SKILL.md), which involve executing code that could be influenced by malicious content in the files being ported.
- Sanitization: No sanitization or validation of the input Go code is described before it is processed or used in shell commands.
- [COMMAND_EXECUTION]: The 'Verification' section in SKILL.md provides specific shell commands ('cargo test', 'cargo clippy', 'go test', 'go vet') for the agent or user to execute. While these are standard for software development, they guide the agent to perform local command execution that interacts with the filesystem and environment.
Audit Metadata