golang-naming

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:07 AM UTC
• Version: 1.2.0

Overview

This Go naming skill is mostly documentation, but it grants broader command, editing, Git, and agent-delegation authority than its naming-review purpose clearly needs.

Review this skill before installing in sensitive repositories. It does not appear malicious, but only use it where broad Go/Git command execution, file edits, and possible delegated agent work are acceptable, or restrict those permissions to read-only review and explicit user-approved validation commands.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:17

Finding

Overly Broad Tool Permissions Violate Least-Privilege Requirements

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Excessive execution, delegation, and repository modification permissions
Risk Level: Medium

Vulnerable configuration:

yaml

allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent

Technical Analysis

The Skill provides Go naming advice and may optionally review or rename identifiers. Its declared functionality does not require unrestricted access to every Go, Git, and agent-delegation operation.

The wildcard permissions Bash(go:*) and Bash(git:*) permit substantially more than read-only validation. Depending on harness enforcement, these patterns may authorize operations such as:

• Executing workspace code through go run, go test, or go generate.
• Downloading dependencies through Go tooling.
• Modifying repository state through Git commands.
• Invoking repository-configured hooks through applicable Git workflows.
• Delegating work to another agent through the unrestricted Agent capability.

The Skill contains no malicious command and does not automatically exercise these permissions. Nevertheless, granting them creates an unnecessary privilege boundary: malicious repository content, evaluation input, or contextual instructions could attempt to induce execution of a permitted but unsafe command.

Read-only tools and narrowly scoped editing are adequate for normal naming reviews. Go compiler or linter access can be granted separately when validation is explicitly requested.

Attack Path

1. An attacker places adversarial instructions or executable Go content in a repository inspected by the Skill.
2. The Skill reads that content while performing a naming review.
3. The content persuades the agent to validate or apply a change using a broadly permitted operation such as go run, go generate, or a mutating Git command.
4. The harness accepts the operation beca ...[truncated 1183 chars]

Remediation

View remediation

Remediation Suggestions

Apply least-privilege controls to the Skill configuration:

1. Remove the unrestricted Agent capability unless delegation is essential and has a narrowly defined security boundary.
2. Replace Bash(git:*) with an allowlist of read-only commands, such as git status, git diff, and git grep.
3. Replace Bash(go:*) with only the validation commands required by the workflow. Explicitly deny go run, go generate, and other commands that execute workspace-controlled code.
4. Allow Edit and Write only when the user explicitly requests code changes; use Read, Glob, and Grep for advisory reviews.
5. Require user confirmation before commands that download dependencies, execute tests, invoke hooks, modify repository state, or access the network.
6. Run permitted Go and Git operations in a sandbox without sensitive environment variables, host credentials, or unrestricted filesystem access.
7. Ensure delegated agents cannot inherit broader permissions than the parent task.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.