golang-pkg-go-dev
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES]: The skill instructs the installation of the
godigCLI utility viago install github.com/samber/godig/cmd/godig@latest. This repository is the official source provided by the skill's author for the purpose of querying Go package metadata. - [DATA_EXPOSURE]: The skill performs network requests to retrieve documentation and metadata from
pkg.go.devand the Go vulnerability database. It also offers the option to connect to a hosted MCP server athttps://godig.samber.dev/mcp, which is an external service managed by the author. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted documentation and README content from the external
pkg.go.devAPI via thegodigtool. - Ingestion points: Documentation, symbols, and README files retrieved through
godigsubcommands. - Boundary markers: No explicit delimiters or instructions to ignore embedded content are defined in the skill's prompts.
- Capability inventory: The environment permits the use of
Write,Edit,Bash, andAgenttools. - Sanitization: The skill does not specify any sanitization or validation logic for the content fetched from the public Go package registry.
Audit Metadata