Golang Linter

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:07 AM UTC
• Version: 1.1.1

Overview

This Go linting skill is mostly coherent, but it grants and encourages broad automated repository changes without enough scoping or user-control safeguards.

Review before installing if you work in repositories where automated edits are risky. Prefer running lint first, only using `--fix` on explicit scopes, reviewing `git diff` afterward, and avoiding parallel cleanup agents unless the work is intentionally planned and isolated.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:21

Finding

Unrestricted Git Tool Permission Enables Arbitrary Command Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: High

Vulnerable code:

yaml

allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent

Technical Analysis

The skill grants unrestricted access to every Git subcommand and argument through Bash(git:*), although the documented linting workflows do not require Git command execution.

This permission is broader than ordinary repository inspection. It permits destructive operations such as git clean, git reset, branch deletion, history rewriting, remote modification, and Git configuration changes. More critically, Git supports shell-command aliases. If the tool-policy matcher only verifies that a command begins with git, an invocation using a temporary alias can execute an arbitrary shell command while still matching the allowed git:* pattern.

For example, the underlying capability can be abused in the following form:

bash

git -c alias.payload='!arbitrary-command' payload

The finding concerns the granted capability; no such malicious command is present in the audited project.

Attack Path

1. The skill is loaded for a Go linting or lint-configuration task.
2. The agent receives permission to execute any command matching Bash(git:*).
3. Malicious or compromised instructions cause the agent to invoke a dangerous Git operation.
4. An attacker can use destructive Git commands directly, modify Git configuration, or define a temporary shell-backed Git alias.
5. The Git process launches the attacker-selected command with the same operating-system privileges and environment as the agent.
6. The command can modify the repository and any other resources accessible to the agent account.

Impact Assessment

Successful exploitation can provide arbitrary command execution under the agent's existing o ...[truncated 746 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash(git:*) because no documented workflow in this skill requires unrestricted Git execution.
2. If revision information is genuinely necessary, grant only narrowly scoped, read-only commands such as git status, git diff, or git rev-parse.
3. Enforce argument-level validation rather than relying exclusively on a command-prefix allowlist.
4. Explicitly reject dangerous options and command families, including:
   • git -c and configuration overrides.
   • git config.
   • Git aliases and shell-backed aliases.
   • git clean, git reset, git checkout, and git restore.
   • Remote, credential, hook, and submodule configuration operations.
5. Run any necessary repository inspection in a restricted environment without write access, sensitive credentials, or unnecessary network connectivity.
6. Review the remaining tool permissions periodically and retain only capabilities directly required by the documented linting workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The parallel cleanup guidance instructs sub-agents to run automated fix operations across ./..., potentially in a legacy codebase, without a warning about widespread modifications or coordination safeguards. In a multi-agent environment this amplifies risk: concurrent automated edits can create large, hard-to-review changes, merge conflicts, and unintended semantic regressions across the repository.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text says to use this skill whenever the user 'runs linters', 'sets up code quality tooling', or asks which linters to enable, which are broad conditions that can overlap with many general coding conversations. It also lacks clear exclusions or negative examples to distinguish when this skill should not activate versus other Go, CI, or general tooling skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent in coding mode to launch golangci-lint run --fix on modified files without first requiring user confirmation or clearly warning that files will be changed. In an autonomous agent setting, normalizing silent auto-fix behavior can lead to unreviewed code modifications, unintended semantic changes, or disruption of a user's working tree.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick reference presents golangci-lint run --fix ./... as a standard command without noting that it writes changes to repository files. In an agent-executed workflow, omission of that warning increases the chance of broad, automatic edits being performed without the user's awareness or review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The recommended workflow says to 'Auto-fix what you can' and gives golangci-lint run --fix ./... as normal practice, but does not require disclosure that this performs automatic edits. In the context of an AI coding agent, this makes unreviewed file mutation part of the default workflow and raises the risk of accidental or repo-wide changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This is a JSON manifest-like file, so SQP-1 applies. The prompt text at L006 begins with a generic user utterance ('I have a Go function...' / 'Write the nolint directives...') and does not define any explicit activation scope, constraints, or negative examples, which could make downstream invocation matching overly broad if prompts are used as routing descriptions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.