The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill specifies the installation of gopls and benchstat from golang.org/x/ via go install. These are official Go tools provided by the Go team. Other referenced tools like gopatch and dst are from well-known repositories within the Go community. These downloads are standard for the skill's purpose and originate from trusted sources.
[INDIRECT_PROMPT_INJECTION]: The skill processes external Go source code which could technically contain malicious instructions (e.g., in comments). However, the skill implements robust mitigation strategies: it requires human approval via the environment's question tool for all significant changes, promotes the use of semantic tools (gopls) that ignore non-code content, and mandates a 'Review mode' for checking all generated PRs. This human-in-the-loop architecture effectively mitigates indirect injection risks.
[COMMAND_EXECUTION]: The skill uses bash to execute standard Go development commands (go build, go test, go vet). These are restricted to the context of the Go toolchain and are necessary for the skill's primary function of verifying refactors.
[CREDENTIALS_SAFE]: The skill encourages the use of .env files for configuration, which is a standard safety practice. It does not contain any hardcoded secrets or instructions to access sensitive credential paths like ~/.ssh or ~/.aws.
[METADATA_POISONING]: All metadata fields (name, description, author, version) are consistent with the provided functionality. The skill provides clear cross-references to other legitimate Go development skills.

golang-refactoring