write-script-go
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the wmill CLI to perform operations such as
wmill script previewto run scripts locally andwmill generate-metadatato update local configuration files. The agent is directed to execute these commands to facilitate the development and testing workflow for Go scripts. - [INDIRECT_PROMPT_INJECTION]: The skill describes a process where user-provided or agent-inferred arguments are passed to the
wmill script previewcommand via the-dflag, creating a potential surface for indirect injection. - Ingestion points: User-provided parameters or instructions used to formulate the
-dargument string for script execution. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are mandated for the interpolated argument strings.
- Capability inventory: The agent can execute Go code through the platform's preview tool and modify local workspace files like
.script.yamlandwmill-lock.yaml. - Sanitization: The skill does not provide instructions for sanitizing or escaping the arguments before they are passed to the shell command for execution.
Audit Metadata