grpc-golang
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process external data sources which could contain malicious instructions.
- Ingestion points: The skill ingests untrusted client-sent metadata (referenced in implementation-playbook.md) and processes Protobuf schema files provided by the user (described in SKILL.md).
- Boundary markers: The instructions lack specific prompt delimiters for external schema content, though they do advise allowlisting metadata keys.
- Capability inventory: The skill uses command-line tools for code generation (buf generate, buf lint) and performs network operations via gRPC server/client implementations.
- Sanitization: The skill explicitly recommends validating and allowlisting metadata keys used for authorization or routing.
- [COMMAND_EXECUTION]: The skill involves the execution of local development tools.
- The guide instructs running
buf lintandbuf generateto validate schemas and produce Go code. These are standard industry tools for gRPC development. - [EXTERNAL_DOWNLOADS]: The configuration examples reference remote resources from a well-known service.
- The
buf.gen.yamlexample fetches Protobuf plugins from the officialbuf.buildregistry during the code generation process.
Audit Metadata