skills/vincentkoc/dotskills/crawlkit/Gen Agent Trust Hub

crawlkit

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute standard Go development and testing commands including go mod tidy, go test, and go vet, as well as Git operations like git tag -v and git diff. It also includes instructions to run application binaries for compatibility checks using commands like <app> metadata --json and <app> status --json.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it is designed to read and process local project documentation and source files to inform its maintenance tasks.\n
  • Ingestion points: Reads files such as AGENTS.md, README.md, CONTRIBUTING.md, and project source code within the crawlkit repository and downstream app branches.\n
  • Boundary markers: None explicitly defined in the instructions to distinguish between instructions and ingested data.\n
  • Capability inventory: Execution of shell commands via the Go and Git toolchains, and execution of local application binaries.\n
  • Sanitization: Relies on standard agent file-reading behavior without specific sanitization or escaping instructions for external content.\n- [EXTERNAL_DOWNLOADS]: The skill references and verifies Go modules from official and vendor-owned sources.\n
  • Fetches module information from the public Go proxy at proxy.golang.org.\n
  • References the vendor's repository at github.com/vincentkoc/crawlkit.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 02:49 AM
Security Audit — agent-trust-hub — crawlkit