modern-go
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run standard Go utilities, including
goimports -w,gofmt -w, and refers togo fix. These commands are used for their legitimate purposes of formatting and refactoring source code within the project environment. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes project-level Go files and thego.modfile, which creates an ingestion surface for potentially untrusted data. \n - Ingestion points: Source files (
.go) and configuration files (go.mod) are gathered and read by the agent. \n - Boundary markers: The instructions do not specify explicit delimiters for code blocks, relying instead on a strict catalog of known Go transformations. \n
- Capability inventory: The agent is authorized to read files, write modifications, and execute local shell-based formatting tools. \n
- Sanitization: The skill incorporates safety mechanisms by gating transformations to the detected Go version and requiring semantic changes to be presented as suggestions rather than auto-applied.
Audit Metadata