ClawHub
Back to skill

Security audit

Go Linter Configuration

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Go linting purpose, but its install steps can run unverified internet code and write into system-wide locations.

Review this skill before installing. Prefer manually installed, version-pinned Go and golangci-lint packages with checksum or signature verification, and avoid running the provided curl-to-sh or /usr/local extraction commands in developer machines or CI without explicit review.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:22
Finding

Mutable Remote Installer Is Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unverified Go Archive Is Extracted into a System-Wide Directory

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding

Unpinned Latest Version Creates a Non-Reproducible Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The metadata install command downloads a tarball and extracts it directly into /usr/local, a privileged system location, without any warning or integrity verification. If the download source is tampered with or the command is run with elevated privileges, it could overwrite system files or install malicious binaries globally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to pipe a remotely fetched script directly into a shell, which executes unreviewed code from the network immediately. If the upstream script, hosting account, or transport path is compromised, users could run arbitrary code on their systems without an opportunity to inspect it first.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The skill metadata includes automatic installation via a remote script piped into sh, which creates a supply-chain risk because external code is executed immediately. Since this appears in metadata, it may be run more implicitly by the agent/tooling, increasing the chance that users execute it without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
{
              "id": "golangci",
              "kind": "script",
              "script": "curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.59.1",
              "bins": ["golangci-lint"],
              "label": "Install golangci-lint",
            },

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The documentation recommends fetching and executing an external install script in one command, which prevents users from reviewing the script before execution. This is a common supply-chain hazard and is more dangerous in a skill because users may treat the guidance as trusted operational advice.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Or use the official installation script:

bash
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.59.1

Basic Usage

External Script Fetching

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The CI example executes a remotely fetched script during automated builds, so a compromise of the upstream script could turn CI runners into an execution vector and potentially expose repository secrets or modify build outputs. Automated environments amplify the blast radius because the command may run repeatedly and without human review.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
- name: Install golangci-lint
      run: |
        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.59.1

    - name: Lint
      run: golangci-lint run --config .golangci.yml ./...

Static analysis

No suspicious patterns detected.