ClawHub
Back to skill

Security audit

golang-concurrency

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Go concurrency helper with disclosed code-reading and code-editing capabilities, and I found no hidden persistence, exfiltration, or deceptive behavior.

Install only if you want the agent to read and possibly edit Go files for concurrency work. Review generated changes before applying them, and be careful with examples in older Go modules, especially loop-variable capture patterns before Go 1.22.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The comment at L296 says the concurrent write is safe because each goroutine writes to its own index, but the closure passed to errgroup.Go captures the loop variables `i` and `url` from the surrounding `for` loop without rebinding them. In Go versions before the newer loop-variable semantics, goroutines may observe the final values instead of per-iteration values, so the comment's safety claim actively contradicts the code as written.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.