z-go-http-client
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill is purely educational and promotes defensive programming and infrastructure resilience.
- [PROMPT_INJECTION]: No attempts to override agent behavior or bypass safety filters were found. The instructions are focused on Go development best practices.
- [DATA_EXFILTRATION]: No sensitive data access or exfiltration patterns detected. The skill explicitly provides guidance on preventing Server-Side Request Forgery (SSRF) when making outbound requests.
- [REMOTE_CODE_EXECUTION]: No remote code execution or suspicious download patterns detected. The external Go packages referenced (e.g., from HashiCorp, Sony, and OpenTelemetry) are well-known, industry-standard libraries for the described purposes (retries, circuit breakers, and observability).
- [OBFUSCATION]: No obfuscated code, hidden URLs, or character-based evasion techniques were found in the file content.
- [COMMAND_EXECUTION]: The verification section includes standard development commands (grep, golangci-lint, go test) for local code analysis and testing, which are benign in this context.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs developers on how to safely handle external data (e.g., response bodies) by limiting size and closing connections, which actually reduces the surface area for certain types of attacks.
Audit Metadata