crawlkit
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute standard Go development and testing commands including
go mod tidy,go test, andgo vet, as well as Git operations likegit tag -vandgit diff. It also includes instructions to run application binaries for compatibility checks using commands like<app> metadata --jsonand<app> status --json.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it is designed to read and process local project documentation and source files to inform its maintenance tasks.\n - Ingestion points: Reads files such as
AGENTS.md,README.md,CONTRIBUTING.md, and project source code within thecrawlkitrepository and downstream app branches.\n - Boundary markers: None explicitly defined in the instructions to distinguish between instructions and ingested data.\n
- Capability inventory: Execution of shell commands via the Go and Git toolchains, and execution of local application binaries.\n
- Sanitization: Relies on standard agent file-reading behavior without specific sanitization or escaping instructions for external content.\n- [EXTERNAL_DOWNLOADS]: The skill references and verifies Go modules from official and vendor-owned sources.\n
- Fetches module information from the public Go proxy at
proxy.golang.org.\n - References the vendor's repository at
github.com/vincentkoc/crawlkit.
Audit Metadata