Back to skill

Security audit

Go

Security checks for vulnerabilities and agentic risk

Overview

This is a Go programming guidance skill with disclosed preference storage and no evidence of hidden execution, credential access, or persistence.

Install this if you want Go-specific coding guidance. Review suggested commands before running them, especially dependency updates, Docker builds, or commands that modify go.mod/go.sum, and note that stated Go preferences may be saved under ~/Clawic/data/go/config.yaml.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · interfaces.md (reported line 56)May include surrounding context.

md
- Embedding a type promotes its methods: `struct{ io.Writer }` satisfies `io.Writer` by delegation. Embedding an interface with a nil value compiles and panics on the first promoted call — a common pattern for "implement only the methods I care about" test stubs, and a common crash when the stub is used more than expected.
- Embedding an *interface* in a struct is the way to build a partial implementation; embedding a **pointer to an interface** is almost always a mistake — an interface is already a reference-like two-word value.
- Shadowing is silent: define `func (s *S) Write(...)` on a struct that embeds `io.Writer` and yours wins, with no `override` keyword and no warning. Grep for the method name before adding one to an embedding type.
- Promotion is not inheritance. A promoted method called on the outer type still has the *inner* receiver: it cannot see the outer struct's fields or call the outer struct's overrides. Code ported from a class hierarchy breaks here first (`structs.md`).
- Ambiguous promotion (two embedded types with the same method at the same depth) is a compile error only at the call site, not at the type declaration.

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modules.md (reported line 38)May include surrounding context.

md
- Default flow: `GOPROXY=https://proxy.golang.org,direct` and `GOSUMDB=sum.golang.org`. Every public module is fetched through the proxy and verified against the checksum database.
- `GOPRIVATE=github.com/mycorp/*` is the one variable to set for private code: it implies `GONOPROXY` and `GONOSUMDB`, so those paths bypass both the proxy and the checksum database.
- Git authentication for private repos: a `.netrc`, an SSH rewrite (`git config --global url."git@github.com:".insteadOf "https://github.com/"`), or a token. The failure mode is a `410 Gone` or a terminal prompt hanging in CI — set `GIT_TERMINAL_PROMPT=0` so it fails fast instead.
- Vendoring: `go mod vendor` writes `vendor/`, and with `go >=1.14` its presence makes `-mod=vendor` the default. It guarantees a hermetic build with no network, at the cost of a large diff on every dependency change. Choose it for air-gapped or compliance builds, not by default.
- `GOFLAGS=-mod=readonly` (the default from `go >=1.16`) makes the build fail rather than silently editing go.mod — keep it, and run `go mod tidy` deliberately.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · deployment.md (reported line 28)May include surrounding context.

| Log lines | Raw user input into a log message | Structured attributes, which quote values (logging.md) |

  • html/template escapes based on where the value lands in the parsed document — that context awareness is the whole point, and it is lost the moment you wrap a value in template.HTML, which means "trusted, do not escape". Every template.HTML on user data is an XSS.
  • filepath.Join cleans the path, resolving .. — so Join("/data", "../etc/passwd") yields /etc/passwd with no error. Containment requires an explicit check:
go
p := filepath.Join(root, name)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · security.md (reported line 26)May include surrounding context.

| Log lines | Raw user input into a log message | Structured attributes, which quote values (logging.md) |

  • html/template escapes based on where the value lands in the parsed document — that context awareness is the whole point, and it is lost the moment you wrap a value in template.HTML, which means "trusted, do not escape". Every template.HTML on user data is an XSS.
  • filepath.Join cleans the path, resolving .. — so Join("/data", "../etc/passwd") yields /etc/passwd with no error. Containment requires an explicit check:
go
p := filepath.Join(root, name)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · structs.md (reported line 39)May include surrounding context.

md
- Shadowing is silent. Define the same method on the outer type and it wins, with no keyword and no warning.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · cli.md (reported line 67)May include surrounding context.

md
## Configuration Files

- Search order that operators expect: `--config` flag → `$XDG_CONFIG_HOME/<tool>/config.yaml` → `~/.config/<tool>/config.yaml` → a system path. Never write outside those without asking.
- `os.UserConfigDir()` and `os.UserCacheDir()` return the right per-OS location; hard-coding `~/.config` breaks on Windows and macOS conventions.
- A missing config file is not an error — defaults are. A *malformed* one is a fatal error with the file path and line in the message.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · cli.md (reported line 67)May include surrounding context.

md
## Configuration Files

- Search order that operators expect: `--config` flag → `$XDG_CONFIG_HOME/<tool>/config.yaml` → `~/.config/<tool>/config.yaml` → a system path. Never write outside those without asking.
- `os.UserConfigDir()` and `os.UserCacheDir()` return the right per-OS location; hard-coding `~/.config` breaks on Windows and macOS conventions.
- A missing config file is not an error — defaults are. A *malformed* one is a fatal error with the file path and line in the message.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · io.md (reported line 84)May include surrounding context.

md
| Mistake | Consequence | Fix |
|---|---|---|
| One `Read` assumed to fill the buffer | Works on files, corrupts on sockets | `io.ReadFull` or `io.Copy` |
| `defer f.Close()` on a written file | Flush error dropped; truncated output looks successful | Named return + `errors.Join(err, f.Close())` |
| `bufio.Writer` never flushed | Tail of the file missing | `defer w.Flush()` before the Close defer |
| `sc.Err()` unchecked after `Scan` | Read failures become short files | Check it, always |

Static analysis

No suspicious patterns detected.