okf-producer-generator
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides architectural guidance, specifications, and library documentation for developers. No malicious patterns, obfuscation, or safety bypasses were detected in the instructions or bundled specifications.
- [COMMAND_EXECUTION]: The skill outlines a standard development workflow for building Go-based CLI tools. It instructs the agent to use build and registration commands such as
make build,go work use, and execution of a validation utility (skills-ref validate). - [EXTERNAL_DOWNLOADS]: The documentation references external Go libraries and drivers, including the core
okf-golibrary from the author's repository and official pure-Go database drivers (e.g.,modernc.org/sqlite,go.mongodb.org/mongo-driver). These are standard dependencies for the development tasks described. - [PROMPT_INJECTION]: The skill defines the Open Knowledge Format (OKF) specification for ingesting and representing data. While this establishes a surface for indirect prompt injection via untrusted markdown bundles, the skill provides technical mitigations including structural delimiters (YAML/Markdown), structural hashing to preserve human-curated content, and a
SanitizeCellutility to escape layout-disrupting characters. - [CREDENTIALS_SAFE]: The guidance includes explicit security warnings against embedding credentials in URIs or command-line arguments. It mandates the use of environment variable bindings for sensitive flags, representing a robust security posture for the tools it helps generate.
Audit Metadata