golang-modernize

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and processes project source code and configuration files, creating a vulnerability surface where malicious comments or code patterns could attempt to influence the agent's logic during a modernization scan.
  • Ingestion points: The skill reads go.mod, .modernize, and all Go source files within the target project codebase.
  • Capability inventory: The skill is authorized to execute shell commands via Bash (restricted to go, git, and golangci-lint tools), write to the filesystem, and orchestrate sub-agents to perform parallel scans.
  • Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore embedded natural language instructions within the source code being analyzed.
  • Sanitization: The skill does not describe any sanitization or validation of content read from source files before it is processed by the LLM.
  • [COMMAND_EXECUTION]: The skill uses shell commands through restricted tool scopes to manage dependencies, run tests, and handle version control operations.
  • Evidence: Invokes go mod tidy, go test, go fix, and various git commands to perform modernization workflows.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official Go development tools and community-recognized libraries.
  • Evidence: Recommends downloading govulncheck, golangci-lint, and stringer from established community repositories using the standard go get mechanism.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 07:03 AM
Security Audit — agent-trust-hub — golang-modernize