golang-dependency-injection
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The 'Refactor mode' described in the instructions uses multiple sub-agents to analyze user-provided Go source code, which represents an indirect prompt injection surface.
- Ingestion points: User source code analyzed during refactoring tasks.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided for the sub-agents.
- Capability inventory: The skill is granted significant capabilities including file system access (Read, Edit, Write) and shell command execution via
Bash(go:*),Bash(golangci-lint:*), andBash(git:*)(SKILL.md). - Sanitization: No explicit sanitization or validation of the ingested code is defined before processing by the sub-agents.
- [SAFE]: All external references point to official documentation and repositories of well-known and reputable organizations including Google, Uber, and the author's own established projects.
- [SAFE]: No evidence of obfuscation, hardcoded credentials, data exfiltration patterns, or persistence mechanisms was found across the skill files.
- [SAFE]: The requested tool permissions are appropriate and scoped for the intended purpose of Go development and documentation retrieval.
Audit Metadata