ClawHub
Back to skill

Security audit

Golang Continuous Integration

Security checks across malware telemetry and agentic risk

Overview

This Go CI skill is mostly purpose-aligned, but its bundled AI review workflow grants broad GitHub permissions and log access that should be reviewed before use.

Treat this as a review-before-install skill, not malware. Static scan and VirusTotal telemetry were clean, and the high-risk behavior is visible in the templates. Before enabling the Claude review workflow, remove unused id-token: write, restrict triggers to trusted contributors or branches, limit actions: read to jobs that truly need logs, disable full output where possible, and ensure branch protection, required checks, and secret hygiene are in place.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The workflow grants `id-token: write` at the top level, which makes OIDC token minting available to every job in the workflow. None of the defined jobs appear to use cloud federation or any OIDC-dependent step, so this is unnecessary privilege that broadens the blast radius if the AI action, a dependency, or a prompt-influenced tool invocation is abused.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The workflow triggers on any submitted pull request review and any created review comment, then runs an AI agent with comment-posting capability. Because the trigger is broad and not limited to specific review states, trusted actors, or bot-authored review artifacts, an attacker can increase opportunities for prompt-injection or socially engineer the agent into posting unwanted content or participating in threads unnecessarily.

Missing User Warnings

Medium
Confidence
75% confidence
Finding
The CI diagnosis job is explicitly allowed to read workflow logs and the action is configured with `show_full_output: true`, increasing the chance that sensitive log contents are surfaced back into model-visible context or reproduced in PR comments. In an AI-assisted workflow, broad log visibility is especially risky because logs may contain tokens, secrets accidentally printed by other steps, or internal infrastructure details that the model could summarize or echo.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.