golang-pkg-go-dev

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—this skill’s required workflow uses godig to query public pkg.go.dev (and vuln.go.dev/OSV) at runtime, and the resulting free-form Markdown/text (e.g., package docs, READMEs, license text, examples) is returned to the agent and placed into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill documents adding and using a hosted MCP endpoint at https://godig.samber.dev/mcp which the agent would call at runtime to fetch data that is injected into the model context and can thus directly influence agent responses.