golang-how-to
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
goplslanguage server usinggo install golang.org/x/tools/gopls@latest. This is a trusted, official repository for Go development tools. - [COMMAND_EXECUTION]: The skill leverages
go,git, andgoplsbinaries through bash commands. These tools are explicitly restricted in theallowed-toolsconfiguration to prevent unauthorized command execution by limiting access to specific binaries. - [PROMPT_INJECTION]: The skill reads project configuration files (like
CLAUDE.mdandAGENTS.md) and scans the codebase for library imports to suggest relevant Go skills. This exposes an indirect prompt injection surface where untrusted project data enters the agent's context. Evidence: 1. Ingestion points:CLAUDE.md,AGENTS.md,go.mod, and codebase (via Grep). 2. Boundary markers: Absent. 3. Capability inventory:Read,Write,Edit, and restrictedBashtools. 4. Sanitization: None described. This surface is inherent to the tool's primary purpose and is considered low risk in this context.
Audit Metadata