Go Security Vulnerability

• Outcome: Pass
• Latest audit: May 28, 2026, 2:22 AM
• Version:
  0.1.0

Overview

This skill appears to do what it claims: help inspect and fix Go vulnerabilities using Go’s official tooling, with one install-step safety caveat.

Install this only if you are comfortable letting the agent install or use Go tooling on the machine. Prefer using an already-installed Go version or manually verify the downloaded Go archive checksum before extracting it into /usr/local.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The install step fetches a tarball over the network with curl and immediately pipes it into tar running as root in /usr/local, with no checksum or signature verification. This creates a supply-chain execution path unrelated to the core analysis task, so a compromised download source, MITM, or tampered artifact could lead to arbitrary code installation on the host.

VirusTotal

65/65 vendors flagged this skill as clean.