okf-producer-generator

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: The skill provides architectural guidance, specifications, and library documentation for developers. No malicious patterns, obfuscation, or safety bypasses were detected in the instructions or bundled specifications.
  • [COMMAND_EXECUTION]: The skill outlines a standard development workflow for building Go-based CLI tools. It instructs the agent to use build and registration commands such as make build, go work use, and execution of a validation utility (skills-ref validate).
  • [EXTERNAL_DOWNLOADS]: The documentation references external Go libraries and drivers, including the core okf-go library from the author's repository and official pure-Go database drivers (e.g., modernc.org/sqlite, go.mongodb.org/mongo-driver). These are standard dependencies for the development tasks described.
  • [PROMPT_INJECTION]: The skill defines the Open Knowledge Format (OKF) specification for ingesting and representing data. While this establishes a surface for indirect prompt injection via untrusted markdown bundles, the skill provides technical mitigations including structural delimiters (YAML/Markdown), structural hashing to preserve human-curated content, and a SanitizeCell utility to escape layout-disrupting characters.
  • [CREDENTIALS_SAFE]: The guidance includes explicit security warnings against embedding credentials in URIs or command-line arguments. It mandates the use of environment variable bindings for sensitive flags, representing a robust security posture for the tools it helps generate.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 08:05 AM
Security Audit — agent-trust-hub — okf-producer-generator