golang-how-to

SUSPICIOUS. The skill is mostly coherent with its stated orchestration purpose and uses an official Go install source, so there is no strong malware signal. The main risk is transitive trust: it persistently configures projects to auto-load itself and additional skills, expanding the agent’s behavior beyond a single reviewed skill.