ClawHub
Back to skill

Security audit

Go Security Vulnerability

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims: help scan and fix Go project vulnerabilities, with one disclosed installation hardening caveat.

Install this only if you are comfortable with the agent installing or using Go tooling on the machine. Prefer an already installed Go version, or manually download and verify the official Go archive checksum before extracting it into /usr/local.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The install step downloads an archive from the network and immediately pipes it into `tar` running as root against `/usr/local`, with no checksum or signature verification and no warning to the user. This creates a supply-chain risk: if the download source, DNS/TLS path, or hosting endpoint is compromised, a malicious tarball could overwrite files or install trojaned tooling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.