gopls-lsp — agentic threat model

Not certain from the listing — relies on Anthropic's Claude models. Threats include prompt injection where malicious code comments or files in the workspace hijack the LLM's instructions during LSP parsing.

The agent operates directly on local Go source code files to provide diagnostics and navigation. There is a risk of data exfiltration if malicious code triggers the agent to read and leak sensitive local files or environment variables.

The framework integrates Claude with the gopls LSP server. Insecure tool integration is a primary threat, as refactoring commands or LSP requests could be manipulated to execute arbitrary code or modify local files in unintended ways.

The gopls server is launched via the plugin manifest. If run without strict sandboxing, a compromise of the LSP plugin allows direct host filesystem access, privilege escalation, and execution of arbitrary Go binaries or build tools.

Not certain from the listing — there is no mention of built-in logging, guardrails, or anomaly detection to monitor the LSP commands being executed or to detect malicious refactoring payloads.

Not certain from the listing — lacks explicit details on authorization boundaries, user confirmation prompts before applying refactoring changes, or compliance with secure coding standards.

The plugin operates within the Anthropic tool/plugin ecosystem. Vulnerabilities could arise if other active agents or plugins can chain calls into the gopls-lsp tool to read or modify the codebase without explicit user consent.