Golang Swagger

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent Go Swagger documentation helper; it can edit project files and install/run the swag CLI, which is expected for its purpose.

This skill appears safe for its stated purpose. Before installing, be aware that it can edit your Go project and run swag/go-related commands, and that the swag CLI install uses the latest upstream version unless you pin it yourself.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may change source files, generate docs, format annotations, or run project commands while helping with Swagger documentation.

Why it was flagged

The skill can edit/write files and run broad Go, swag, lint, and git commands. These tools fit a Go Swagger documentation workflow, but they can still modify the user's repository.

Skill content

allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) ... Bash(swag:*)

Recommendation

Review file diffs and command output before accepting changes, especially for generated docs and any git-related operations.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing with @latest may fetch a newer upstream version than expected.

Why it was flagged

The required swag CLI is installed from an external Go module using @latest, which is normal for this tool but does not pin an exact reviewed version.

Skill content

package: github.com/swaggo/swag/cmd/swag@latest

Recommendation

If reproducibility matters, pin the swag version or install it through your organization's approved dependency process.