cobra
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill promotes security best practices for CLI development, such as avoiding global state to prevent data leakage between executions and using explicit argument validation (e.g., NoArgs, ExactArgs) to prevent unintended logic execution.
- [EXTERNAL_DOWNLOADS]: The skill provides links to official documentation and examples on GitHub (spf13/cobra and tpscloud/gophers) for developer reference.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by documenting how to process user input via command-line arguments and flags. Findings: 1. Ingestion points: Command line arguments and flags defined in references/commands.md. 2. Boundary markers: The skill instructs using cobra.NoArgs and cobra.ExactArgs for validation. 3. Capability inventory: Tools built using these patterns interact with core services and write to standard output streams. 4. Sanitization: The skill emphasizes explicit argument validation and the use of structured output (JSON) to ensure predictable behavior.
Audit Metadata