golang-swagger
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project source code to extract API annotations, which is an inherent part of its function but represents a standard ingestion surface. The severity is considered safe as it is central to the skill's purpose.\n
- Ingestion points: The skill reads Go source files (
**/*.go) to parse Swagger comments.\n - Boundary markers: There are no explicit instructions to the agent regarding the separation of code comments from its operational logic.\n
- Capability inventory: The skill possesses file writing and command execution capabilities necessary for documentation generation.\n
- Sanitization: Extracted annotation content is processed by the standard
swagutility without additional intermediate filtering.\n- [EXTERNAL_DOWNLOADS]: The skill automates the installation of documentation utilities from well-known sources during setup.\n - Evidence: It executes
go install github.com/swaggo/swag/cmd/swag@latest, targeting a standard and widely-used tool in the Go ecosystem.\n- [COMMAND_EXECUTION]: The skill utilizes command-line tools to generate and maintain documentation.\n - Evidence: It calls
swag initandswag fmtvia a restricted shell environment to process API documentation metadata.
Audit Metadata