The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to malicious instructions embedded in project configuration files or tool outputs.
Ingestion points: Ingests data from go.mod, go.sum, and outputs from command-line tools like go list and govulncheck (SKILL.md, auditing.md).
Boundary markers: No specific delimiters or "ignore" instructions are provided to the agent for handling these inputs.
Capability inventory: The agent has access to file modification (Edit, Write) and shell execution (Bash(go:*), Bash(git:*), Bash(govulncheck:*)).
Sanitization: Lacks sanitization or validation logic for the ingested content before use in logic or command construction.
[REMOTE_CODE_EXECUTION]: Instructions involve downloading and executing code from external repositories.
Patterns: Recommends go get -tool and go install for several utilities.
Sources: Includes non-vendor, third-party repositories such as github.com/psampaz/go-mod-outdated, github.com/jondot/goweight, and github.com/Zxilly/go-size-analyzer (auditing.md, SKILL.md).
[EXTERNAL_DOWNLOADS]: Recommends the use of various third-party Go ecosystem tools hosted on GitHub.
Evidence: References to psampaz/go-mod-outdated, jondot/goweight, and Zxilly/go-size-analyzer for auditing and binary size analysis tasks.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its primary functions.
Evidence: Extensively uses go toolchain commands, git for version control, and govulncheck to manage dependencies and perform security scans.

golang-dependency-management