golang-lint

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 1.4.0

Overview

This skill gives Go linting guidance and uses normal linting tools, with a few disclosed operational cautions but no evidence of hidden, deceptive, destructive, or unrelated behavior.

Before installing, prefer a pinned golangci-lint version instead of @latest, review changes before accepting any --fix output, and invoke the skill for Go linting tasks rather than unrelated development work.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned installation of golangci-lint from the latest upstream revision

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 39
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable code snippet:

markdown

**Dependencies:**

- golangci-lint: `go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest`

Technical Analysis

The dependency installation instruction uses the mutable @latest version selector. Consequently, the code downloaded and compiled depends on the upstream state at installation time rather than a version reviewed and approved with this skill.

go install retrieves the selected module and its dependency graph, compiles it, and writes an executable to the user's Go binary directory. If a newly released upstream version or one of its dependencies is compromised, malicious code could execute when the resulting binary is subsequently invoked. The use of @latest also prevents reproducible installation and allows behavior to change without any modification to this repository.

The referenced package is a legitimate, widely used project; no evidence in the audited files establishes that it is currently compromised. The vulnerability is the avoidable supply-chain exposure caused by selecting an unpinned future release.

Attack Path

1. An attacker compromises the upstream project release process, a maintainer account, or a dependency included by a future release.
2. The attacker publishes a malicious version that becomes the version selected by @latest.
3. A user or agent follows the dependency instruction and runs: go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest.
4. Go downloads and compiles the attacker-controlled release and installs the binary under the user's account.
5. The skill later invokes golangci-lint, causing the compromised binary to run with the invoking user's privileges.

Impact Assessment

Successful exploitation could provide arbitrary co ...[truncated 595 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, immutable version, for example:

  markdown

  - golangci-lint: `go install github.com/golangci/golangci-lint/cmd/golangci-lint@v2.6.2`
  

• Establish a controlled dependency-update process that reviews release notes, source changes, and security advisories before changing the pinned version.

• Keep the approved version synchronized across local development and CI configuration to ensure reproducible behavior.

• Where practical, verify downloaded release artifacts with publisher-provided checksums, signatures, or attestations.

• Run the linter with least privilege in an isolated CI environment, without unnecessary production credentials or write access outside the checked-out repository.

• Consider maintaining approved binaries in a trusted internal artifact registry after verification.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description contains broad trigger phrases like 'setting up code quality tooling' and 'choosing linters,' plus references to common Go tools, which can cause the skill to activate for ordinary development requests beyond narrowly scoped linting help. Over-broad activation increases the chance that the harness invokes this skill in contexts where its strong workflow guidance and tool permissions influence actions unexpectedly, including launching sub-agents or running shell commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.