ClawHub
Back to skill

Security audit

Go Data Persistence

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Go database skill; its database-changing examples are visible and relevant to migration guidance.

Before applying the migration examples to a real database, confirm the target database URL, review both up and down migration files, ensure backups or recovery plans exist, avoid casual rollback or force commands in production, and consider pinning the golang-migrate CLI version instead of installing @latest.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This markdown file includes commands to roll back all migrations and examples of dropping tables/columns, which can delete schema objects and data. Although the document discusses reversibility later, it does not provide a clear user-facing warning near the rollback commands that these actions may permanently remove data or should only be used with backups and verification.

Session Persistence

Medium
Category
Rogue Agent
Content
ALTER TABLE users ADD COLUMN IF NOT EXISTS legacy_field TEXT;
```

Document in comments when a down migration cannot fully restore the previous state.

## Migration Rules
Confidence
55% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.