golang-pkg-go-dev
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the
godigCLI tool from a remote repository using the commandgo install github.com/samber/godig/cmd/godig@latest. The source code is retrieved from an external GitHub repository belonging to the skill's author. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes package documentation, API signatures, and README files from the internet (pkg.go.dev). This content is external and untrusted, creating a potential surface where malicious instructions could be embedded in a library's documentation to influence the agent's behavior.
- Ingestion points: Data retrieved via
godigcommands such aspackage doc,symbol doc, andmodule readme(referenced in SKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions for the agent to distinguish between library documentation and agent-level commands.
- Capability inventory: The skill environment allows for file system operations (
Read,Write,Edit) and shell command execution via theBashtool. - Sanitization: The skill does not specify any sanitization, filtering, or validation of the documentation content before it is processed by the agent.
Audit Metadata