Golang Samber Slog

• Outcome: Review
• Latest audit: May 28, 2026, 1:14 PM
• Version:
  1.0.4

Overview

This Go logging skill is coherent, but it shows agents how to enable request-body logging without enough safeguards against leaking private data into logs.

Review before installing in production coding workflows. Use it only with a standing rule that agents must not enable request/response body or broad header logging by default, and require explicit scoping, redaction, size limits, sensitive-endpoint exclusions, retention controls, and user approval for any external log sink.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation description is broad enough to trigger on general Go `slog` work, not just projects using the `github.com/samber/slog-*` ecosystem. In an agent setting, over-broad activation can inject irrelevant guidance into unrelated tasks, increasing the chance of inappropriate code changes or dependency recommendations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The HTTP middleware section explicitly enables `WithRequestBody: true` and discusses request/response body logging without a strong warning about secrets, tokens, credentials, or regulated data exposure. In a logging-focused skill, this is more dangerous because users may copy the example directly into production middleware and start exfiltrating sensitive payloads into logs and downstream sinks.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly demonstrates enabling request and response body logging, which can easily capture credentials, tokens, session data, PII, or other secrets. In an HTTP middleware skill, this is more dangerous because users may copy these examples directly into production services, causing broad accidental data exposure through logs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file documents options to log headers and client IPs without caution about privacy, compliance, or secret leakage. Headers commonly contain Authorization tokens, cookies, API keys, and identifying data, so presenting these fields as ordinary configuration in reusable middleware increases the likelihood of unsafe default adoption.

VirusTotal

VirusTotal findings are pending for this skill version.