Golang

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be an offline local logger for Go-related development notes, not a tool that actually builds, tests, lints, or formats Go code.

Install only if you want a local history log for Go-related work. Do not rely on it to actually build, test, lint, or format code, and avoid entering secrets because entries are saved under ~/.local/share/golang.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

You may think this skill ran Go build, test, lint, or format commands when it only recorded a note.

Why it was flagged

The headline description sounds like active Go tooling, but the documented commands record user-supplied text entries. This could create false expectations if a user or agent assumes tests or formatting were actually performed.

Skill content

description: "Build, test, lint, and format Go projects..." ... "With arguments: Saves the input with a timestamp to <command>.log"

Recommendation

Use real Go tools such as go test, go build, gofmt, or golangci-lint for actual code operations, and treat this skill only as a local activity log.

Low

#ASI06: Memory and Context Poisoning

What this means

Private filenames, bug details, or other project information you enter may remain on disk until manually removed.

Why it was flagged

The skill keeps persistent local logs and exports of user-provided entries, which is expected for a logging tool but can retain sensitive project notes if users enter them.

Skill content

All data is stored locally at `~/.local/share/golang/` ... `history.log` ... `export.json`, `export.csv`, `export.txt`

Recommendation

Avoid logging secrets or sensitive code details, and periodically review or delete files under ~/.local/share/golang if needed.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Setup behavior may be unclear, and the command may not be available unless the platform or user installs the script separately.

Why it was flagged

The package includes a script and CLI-style documentation, but the registry metadata does not describe how the `golang` command is installed or invoked.

Skill content

No install spec — this is an instruction-only skill. Code file presence: scripts/script.sh

Recommendation

Verify how the skill is installed and invoked before relying on it in workflows.