z-go-pkg
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Queries the official pkg.go.dev API to retrieve Go module metadata, package info, and search results.
- [COMMAND_EXECUTION]: Employs curl to fetch data from the API and jq to process the resulting JSON responses.
- [REMOTE_CODE_EXECUTION]: Provides instructions to install a reference CLI tool from the official Go repository (golang.org/x/pkgsite) using go install with a pinned version tag.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as package synopses and symbol names which are provided by third-party package maintainers.
- Ingestion points: Metadata returned from the pkg.go.dev API (SKILL.md).
- Boundary markers: Not specified for the retrieved content.
- Capability inventory: Shell access for curl, jq, and go install (SKILL.md).
- Sanitization: Not explicitly implemented for the external package metadata.
Audit Metadata