golang-swagger

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project source code to extract API annotations, which is an inherent part of its function but represents a standard ingestion surface. The severity is considered safe as it is central to the skill's purpose.\n
  • Ingestion points: The skill reads Go source files (**/*.go) to parse Swagger comments.\n
  • Boundary markers: There are no explicit instructions to the agent regarding the separation of code comments from its operational logic.\n
  • Capability inventory: The skill possesses file writing and command execution capabilities necessary for documentation generation.\n
  • Sanitization: Extracted annotation content is processed by the standard swag utility without additional intermediate filtering.\n- [EXTERNAL_DOWNLOADS]: The skill automates the installation of documentation utilities from well-known sources during setup.\n
  • Evidence: It executes go install github.com/swaggo/swag/cmd/swag@latest, targeting a standard and widely-used tool in the Go ecosystem.\n- [COMMAND_EXECUTION]: The skill utilizes command-line tools to generate and maintain documentation.\n
  • Evidence: It calls swag init and swag fmt via a restricted shell environment to process API documentation metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:11 PM
Security Audit — agent-trust-hub — golang-swagger