golang-documentation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:02 AM UTC
• Version: 1.2.0

Overview

The skill is a coherent Go documentation helper, but it asks for broader Git and network authority than documentation work needs.

Install only if you are comfortable letting the skill edit documentation and Go files, run Go and linter commands, fetch web content, delegate to sub-agents, and access the full Git command surface. Review Git operations before allowing remote, history-changing, config-changing, reset, clean, checkout, or push actions, and prefer pinned versions over :latest in generated Docker instructions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:17

Finding

Overbroad Git and Network Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17
Vulnerability Type: Excessive tool authorization
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch

Technical Analysis

The Skill is intended to write and review Go documentation. File access and narrowly scoped validation commands are appropriate, but Bash(git:*) authorizes the complete Git command surface rather than only the read-only operations needed to inspect documentation changes.

This permission can include destructive repository operations, remote operations, Git configuration changes, and commands that invoke configured helpers or external programs. Unrestricted WebFetch also permits retrieval of content from arbitrary external locations. Although the reviewed Skill contains no instruction that directly abuses these capabilities, granting them creates an unnecessary privilege boundary violation and increases the impact of malicious user input, repository content, or externally retrieved instructions.

Agent access can further amplify the exposed surface by delegating tasks to sub-agents, although sub-agent orchestration is part of the Skill's declared workflow. The primary least-privilege issue is the unrestricted Git and outbound-fetch capability.

The pre-scan alert concerning evals/evals.json:35 was also reviewed. That line is an evaluation prompt containing a shields.io badge URL and go get text; it does not download or execute an executable and does not reference a personal paste or code-hosting service. It is therefore not a confirmed remote-payload vulnerability.

Attack Path

1. An attacker supplies a crafted documentation request, repository document, or other content processed during a documentation audit.
2. The content attempts to persuade the agent to perform an operation framed as necessary for documentation work, such a ...[truncated 1659 chars]

Remediation

View remediation

Remediation Suggestions

Apply explicit least-privilege restrictions:

1. Replace Bash(git:*) with a small allowlist of read-only commands required for documentation review, such as:

   • git status
   • git diff
   • git log
   • git show
   • git ls-files

2. Do not authorize mutation or remote operations by default, including git push, git reset, git clean, git checkout, git switch, git config, and remote-management commands.

3. Require explicit user confirmation before any operation that changes repository history, contacts a remote, publishes content, or modifies Git configuration.

4. Restrict WebFetch to approved documentation domains such as go.dev, pkg.go.dev, and the user-specified project host. Block private-network, loopback, link-local, and arbitrary redirect destinations.

5. Treat fetched pages and repository documentation as untrusted data. Do not follow instructions embedded in that content, and do not execute downloaded material.

6. Constrain delegated agents to the same or a narrower tool policy. Limit sub-agents to the files or documentation layer assigned to them.

7. Where supported, run Git commands with credential prompts disabled and outbound network access denied unless a remote operation has been explicitly approved.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/templates/README.md (reported line 3)May include surrounding context.

md

# {project-name}

<!-- Replace {owner} and {repo} throughout this file -->

[![Go Version](https://img.shields.io/github/go-mod/go-version/{owner}/{repo})](https://go.dev/) [![License](https://img.shields.io/github/license/{owner}/{repo})](./LICENSE) [![Build Status](https://img.shields.io/github/actions/workflow/status/{owner}/{repo}/test.yml?branch=main)](https://github.com/{owner}/{repo}/actions) [![Coverage](https://img.shields.io/codecov/c/github/{owner}/{repo})](https://codecov.io/gh/{owner}/{repo}) [![Go Report Card](https://goreportcard.com/badge/github.com/{owner}/{repo})](https://goreportcard.com/report/github.com/{owner}/{repo}) [![Go Reference](https://pkg.go.dev/badge/github.com/{owner}/{repo}.svg)](https://pkg.go.dev/github.com/{owner}/{repo})

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/code-comments.md (reported line 239)May include surrounding context.

md

//
// # Token Lifecycle
//
// Access tokens expire after 15 minutes. Refresh tokens expire after 7 days.
// Token rotation is automatic — each refresh request issues a new refresh token
// and invalidates the previous one.
//

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description says to use the skill when "writing or reviewing doc comments, documentation, adding code examples, setting up doc sites, or discussing documentation best practices," which is a very broad set of common activities. It does not define specific trigger phrases, scope boundaries, or exclusion conditions, so the skill could be invoked for many ordinary documentation-related conversations unintentionally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · assets/templates/README.md (reported line 47)May include surrounding context.

md

Download from [GitHub Releases](https://github.com/{owner}/{repo}/releases/latest).

| Platform | Architecture | Download                                                                                        |
| -------- | ------------ | ----------------------------------------------------------------------------------------------- |
| Linux    | amd64        | [Download](https://github.com/{owner}/{repo}/releases/latest/download/{repo}-linux-amd64)       |
| Linux    | arm64        | [Download](https://github.com/{owner}/{repo}/releases/latest/download/{repo}-linux-arm64)       |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The template recommends pulling a Docker image using the mutable ':latest' tag rather than a pinned version or digest. This is a supply-chain risk because consumers may fetch different or unexpectedly modified images over time, reducing reproducibility and increasing exposure if the registry or tag is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The 'docker run --rm {registry}/{owner}/{repo}:latest --help' example executes a mutable image tag, so users may run unreviewed or changed code from the registry. Although '--rm' itself is not the issue, coupling execution with ':latest' increases supply-chain risk and can lead to unsafe or non-reproducible behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The phrase "Triggers for both libraries and applications/CLIs" expands scope but does not clarify when the skill should activate within those contexts or what requests should not trigger it. Because the file is a markdown/manifest-style skill description, missing trigger constraints here can cause accidental activation across many Go-related tasks.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/templates/README.md (reported line 65)May include surrounding context.

bash

docker pull {registry}/{owner}/{repo}:latest
docker run --rm {registry}/{owner}/{repo}:latest --help

Homebrew (macOS)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes an authentication example using os.Getenv("API_TOKEN"), which demonstrates access to sensitive credentials. Under the markdown variant of SQP-2, documentation should warn when examples touch privacy- or security-sensitive data, but no warning or handling guidance is provided nearby.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The example hard-codes a date format (2026-03-08) as the presented changelog style, which can be interpreted as enforcing a specific locale/date convention. Under the policy, locale-related conventions should either allow user choice or be clearly justified as a documented standard.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.