Back to skill

Security audit

Go

Security checks for vulnerabilities and agentic risk

Overview

This is a Go programming guidance skill with disclosed preference storage and no evidence of hidden execution, credential access, or persistence.

Install this if you want Go-specific coding guidance. Review suggested commands before running them, especially dependency updates, Docker builds, or commands that modify go.mod/go.sum, and note that stated Go preferences may be saved under ~/Clawic/data/go/config.yaml.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
- Embedding a type promotes its methods: `struct{ io.Writer }` satisfies `io.Writer` by delegation. Embedding an interface with a nil value compiles and panics on the first promoted call — a common pattern for "implement only the methods I care about" test stubs, and a common crash when the stub is used more than expected.
- Embedding an *interface* in a struct is the way to build a partial implementation; embedding a **pointer to an interface** is almost always a mistake — an interface is already a reference-like two-word value.
- Shadowing is silent: define `func (s *S) Write(...)` on a struct that embeds `io.Writer` and yours wins, with no `override` keyword and no warning. Grep for the method name before adding one to an embedding type.
- Promotion is not inheritance. A promoted method called on the outer type still has the *inner* receiver: it cannot see the outer struct's fields or call the outer struct's overrides. Code ported from a class hierarchy breaks here first (`structs.md`).
- Ambiguous promotion (two embedded types with the same method at the same depth) is a compile error only at the call site, not at the type declaration.
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Credential Access

High
Category
Privilege Escalation
Content
- Default flow: `GOPROXY=https://proxy.golang.org,direct` and `GOSUMDB=sum.golang.org`. Every public module is fetched through the proxy and verified against the checksum database.
- `GOPRIVATE=github.com/mycorp/*` is the one variable to set for private code: it implies `GONOPROXY` and `GONOSUMDB`, so those paths bypass both the proxy and the checksum database.
- Git authentication for private repos: a `.netrc`, an SSH rewrite (`git config --global url."git@github.com:".insteadOf "https://github.com/"`), or a token. The failure mode is a `410 Gone` or a terminal prompt hanging in CI — set `GIT_TERMINAL_PROMPT=0` so it fails fast instead.
- Vendoring: `go mod vendor` writes `vendor/`, and with `go >=1.14` its presence makes `-mod=vendor` the default. It guarantees a hermetic build with no network, at the cost of a large diff on every dependency change. Choose it for air-gapped or compliance builds, not by default.
- `GOFLAGS=-mod=readonly` (the default from `go >=1.16`) makes the build fail rather than silently editing go.mod — keep it, and run `go mod tidy` deliberately.
Confidence
80% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
| Log lines | Raw user input into a log message | Structured attributes, which quote values (`logging.md`) |

- `html/template` escapes based on where the value lands in the parsed document — that context awareness is the whole point, and it is lost the moment you wrap a value in `template.HTML`, which means "trusted, do not escape". Every `template.HTML` on user data is an XSS.
- `filepath.Join` **cleans** the path, resolving `..` — so `Join("/data", "../etc/passwd")` yields `/etc/passwd` with no error. Containment requires an explicit check:

```go
p := filepath.Join(root, name)
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
| Log lines | Raw user input into a log message | Structured attributes, which quote values (`logging.md`) |

- `html/template` escapes based on where the value lands in the parsed document — that context awareness is the whole point, and it is lost the moment you wrap a value in `template.HTML`, which means "trusted, do not escape". Every `template.HTML` on user data is an XSS.
- `filepath.Join` **cleans** the path, resolving `..` — so `Join("/data", "../etc/passwd")` yields `/etc/passwd` with no error. Containment requires an explicit check:

```go
p := filepath.Join(root, name)
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
- Shadowing is silent. Define the same method on the outer type and it wins, with no keyword and no warning.
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Configuration Files

- Search order that operators expect: `--config` flag → `$XDG_CONFIG_HOME/<tool>/config.yaml` → `~/.config/<tool>/config.yaml` → a system path. Never write outside those without asking.
- `os.UserConfigDir()` and `os.UserCacheDir()` return the right per-OS location; hard-coding `~/.config` breaks on Windows and macOS conventions.
- A missing config file is not an error — defaults are. A *malformed* one is a fatal error with the file path and line in the message.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content
## Configuration Files

- Search order that operators expect: `--config` flag → `$XDG_CONFIG_HOME/<tool>/config.yaml` → `~/.config/<tool>/config.yaml` → a system path. Never write outside those without asking.
- `os.UserConfigDir()` and `os.UserCacheDir()` return the right per-OS location; hard-coding `~/.config` breaks on Windows and macOS conventions.
- A missing config file is not an error — defaults are. A *malformed* one is a fatal error with the file path and line in the message.
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Context Window Stuffing

Medium
Category
Memory Poisoning
Content
| Mistake | Consequence | Fix |
|---|---|---|
| One `Read` assumed to fill the buffer | Works on files, corrupts on sockets | `io.ReadFull` or `io.Copy` |
| `defer f.Close()` on a written file | Flush error dropped; truncated output looks successful | Named return + `errors.Join(err, f.Close())` |
| `bufio.Writer` never flushed | Tail of the file missing | `defer w.Flush()` before the Close defer |
| `sc.Err()` unchecked after `Scan` | Read failures become short files | Check it, always |
Confidence
85% confidence
Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Static analysis

No suspicious patterns detected.