ClawHub
Back to skill

Security audit

golang-database

Security checks for vulnerabilities and agentic risk

Overview

This is a scoped Go database coding guide with no hidden installer, persistence, exfiltration, or destructive self-executing behavior found.

Install this only if you want an opinionated Go database helper that may edit Go repository files and guide database-access implementation. Review generated code before running it against real databases, and require explicit approval before connecting any SQL tool to production or applying schema, migration, or index changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · evals/evals.json (reported line 21)May include surrounding context.

json
"name": "exec-vs-query-for-non-select",
    "description": "Tests the subtle rule that db.Query must NOT be used for statements that don't return rows",
    "prompt": "Write a Go function that deletes expired sessions from a PostgreSQL database. Use sqlx. The function should delete all sessions where expires_at < now() and return the number of deleted rows.",
    "trap": "The model may use db.QueryContext or db.Query for the DELETE statement, which returns *Rows that must be closed. The skill says to use db.Exec for statements that don't return rows.",
    "assertions": [
      {"id": "2.1", "text": "Uses ExecContext (not QueryContext or Query) for the DELETE statement"},
      {"id": "2.2", "text": "Uses the *Context variant (ExecContext, not Exec)"},

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · evals/evals.json (reported line 23)May include surrounding context.

json
"name": "exec-vs-query-for-non-select",
    "description": "Tests the subtle rule that db.Query must NOT be used for statements that don't return rows",
    "prompt": "Write a Go function that deletes expired sessions from a PostgreSQL database. Use sqlx. The function should delete all sessions where expires_at < now() and return the number of deleted rows.",
    "trap": "The model may use db.QueryContext or db.Query for the DELETE statement, which returns *Rows that must be closed. The skill says to use db.Exec for statements that don't return rows.",
    "assertions": [
      {"id": "2.1", "text": "Uses ExecContext (not QueryContext or Query) for the DELETE statement"},
      {"id": "2.2", "text": "Uses the *Context variant (ExecContext, not Exec)"},

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest says the skill is a comprehensive guide for Go database access and specifically says it does not generate database schemas or migration SQL. This eval only tests refusal to generate schemas, while the manifest separately disallows migration SQL as well; the documented scope and the tested behavior are therefore not fully aligned. The mismatch suggests the implemented skill intent may differ from the manifest boundary around schema and migration assistance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest presents the skill as a comprehensive database-access guide for Go, not as an anti-ORM advocacy skill. The eval text and assertions require the model to explain why ORMs are 'harmful' and to avoid GORM or ent categorically, which is a stronger stance than the manifest communicates. That creates a documentation-versus-intended-behavior divergence in the skill materials.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The text frames the section as strictly advisory and says index changes should never be executed by the skill itself. However, it immediately instructs use of a SQL MCP tool to query a live database for index metadata, which is an active capability rather than purely static guidance; while not destructive, this softens the stated boundary in the documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.