The Agent Skills Directory

[PROMPT_INJECTION]: Deceptive metadata and technical misinformation. The skill references Go version 1.26 and features like the 'Green Tea garbage collector' and 'new with initial value' expressions, which do not exist in the official Go language specification. This misinformation could lead the agent to produce invalid code or accept malicious constructs presented as 'modern' features.- [PROMPT_INJECTION]: Indirect Prompt Injection vulnerability surface. * Ingestion points: Reads go.mod and Go source files from the local workspace using the Read tool. * Boundary markers: Absent; the instructions do not include delimiters or warnings to ignore instructions embedded within the processed source code. * Capability inventory: The skill utilizes the Bash tool to execute go build, go test, go run, and go generate. * Sanitization: Absent; the agent is directed to execute commands directly on workspace files without content verification.- [COMMAND_EXECUTION]: Runtime execution of local workspace content. The use of go test and go generate triggers the execution of code defined within the project (such as init() functions in test files or shell commands in //go:generate directives). This can be exploited to achieve arbitrary code execution if the workspace contains malicious files.- [EXTERNAL_DOWNLOADS]: Remote dependency fetching. The skill encourages the use of go get and go mod download, which fetch code from external repositories. While standard for Go development, this represents a supply chain risk as the skill does not provide mechanisms to verify the integrity or source of these external modules.

Go Ecosystem