golang-gopls

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill facilitates semantic code intelligence for Go development by integrating the official Go language server, gopls. This enables features like go-to-definition, find references, and safe refactoring within a Go workspace.
  • [EXTERNAL_DOWNLOADS]: The skill installs gopls using go install golang.org/x/tools/gopls@latest. This download targets the official, trusted domain for the Go programming language toolchain and is standard practice for Go development.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests local Go source code (**/*.go), which represents an attack surface for indirect prompt injection if a file contains malicious comments or code designed to influence agent behavior through diagnostics or documentation summaries.
  • Ingestion points: Project source files are read from the local filesystem (SKILL.md, references/matrix.md).
  • Capability inventory: The skill executes go, gopls, git, and golangci-lint to analyze and manage code (SKILL.md, references/mcp.md).
  • Boundary markers: The skill relies on standard tool outputs and does not include explicit prompt delimiters for the processed code.
  • Sanitization: Data is processed via standard semantic analysis tools which generate structured responses for the agent.
  • [COMMAND_EXECUTION]: The skill leverages official development binaries (go, gopls, git, golangci-lint) to perform code intelligence tasks. These tools are restricted to their intended purposes within the Go build and analysis environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 07:03 AM
Security Audit — agent-trust-hub — golang-gopls