ClawHub
Back to skill

Security audit

golang-benchmark

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Go benchmarking and profiling guide, but users should be careful with its diagnostic-server, insecure TLS, and privileged CI tuning examples.

Install only if you want Go benchmark and profiling assistance. Treat generated profiles and traces as sensitive diagnostics, keep pprof/trace UIs local or access-controlled, do not use insecure TLS against production services, and run the sudo CPU-tuning commands only on dedicated benchmark runners you administer.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The document includes `go tool pprof https+insecure://...`, which explicitly disables TLS certificate verification when fetching profiles from a remote service. Even in documentation, this normalizes an unsafe practice that can expose sensitive profiling data to man-in-the-middle interception or spoofed endpoints, especially because pprof data can reveal code structure, stack traces, and runtime behavior.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples explicitly log business/request identifiers into execution traces without warning that trace artifacts may be stored, shared, or inspected outside the production context. Trace files often contain rich runtime context, so encouraging identifier logging can lead to inadvertent exposure of sensitive or regulated data during performance investigations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation shows binding the trace web UI to 0.0.0.0 for remote access but provides no security warning, which can expose detailed runtime diagnostics to any reachable host. If used as written in a non-isolated environment, this can leak internal execution details and increase attack surface through unauthenticated profiling interfaces.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
set -euo pipefail

echo "=== Configuring CPU for stable benchmarks ==="
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true
echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true
Confidence
95% confidence
Finding
This command writes to privileged sysfs CPU governor settings via sudo, changing host-level kernel/runtime behavior. In a CI skill, publishing copy-pastable root commands can cause system-wide instability or weaken isolation if run on non-dedicated runners, and the wildcard cpu* path increases blast radius across all CPUs.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
echo "=== Configuring CPU for stable benchmarks ==="
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true
echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

echo "=== Running benchmarks on isolated cores ==="
Confidence
94% confidence
Finding
This command uses sudo to disable Intel Turbo Boost by writing to a privileged kernel control. Disabling CPU features at runtime affects the entire machine and co-located workloads, so if followed in the wrong environment it can degrade service behavior or violate operational safeguards.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
echo "=== Configuring CPU for stable benchmarks ==="
echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true
echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

echo "=== Running benchmarks on isolated cores ==="
taskset -c 2,3 go test -bench=. -benchmem -count=10 ./... | tee bench.txt
Confidence
94% confidence
Finding
This command uses sudo to disable SMT system-wide through sysfs, which is a privileged host configuration change with broad availability and performance consequences. In CI guidance, this is dangerous because users may run it on shared or production-adjacent systems despite the warning, causing service disruption or unintended security/performance tradeoffs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.