Back to skill
Skillv1.0.0
ClawScan security
Go Patterns · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 4, 2026, 3:12 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only, educational Go patterns skill whose examples, requirements, and instructions are consistent with its stated purpose and do not request or install anything unexpected.
- Guidance
- This skill is an educational recipe collection for Go and appears coherent. Before copying examples into production: (1) do not paste real credentials from your environment into examples — replace placeholders; (2) review and audit any dependency (pgx, chi, cobra, etc.) versions you add to your project; (3) test examples in a sandboxed/dev environment first; and (4) if you plan to let an agent run code based on these patterns, ensure it cannot access your secrets or sensitive host files.
Review Dimensions
- Purpose & Capability
- okThe name/description (Go patterns: concurrency, error handling, HTTP, pgx, gRPC, testing, Cobra) match the SKILL.md content. There are no extraneous environment variables, binaries, or install steps that would be unrelated to teaching Go best practices.
- Instruction Scope
- okSKILL.md contains only code examples and prose about Go idioms and architecture. It does not instruct the agent to read user files, access unrelated system paths, exfiltrate data, or call external endpoints beyond illustrative examples. Example connection strings and file reads are sample code for developers, not runtime instructions for the agent to access the host environment.
- Install Mechanism
- okNo install spec and no code files are present. Because this is instruction-only, nothing is written to disk or downloaded by the skill itself, which minimizes install risk.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. Sample snippets show placeholder credentials (e.g., postgres://user:pass) but there is no request for real secrets or unrelated credentials.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system presence or modify other skills. Autonomous invocation is allowed by default but is not concerning here given the skill's educational nature and lack of requested privileges.