ClawHub
Back to skill

Security audit

golang-observability

Security checks across malware telemetry and agentic risk

Overview

This Go observability skill is coherent and install-safe, with deployment risks users should review around telemetry privacy and metric cardinality.

Before installing, be comfortable with a skill that can help edit Go instrumentation and audit a codebase. Review any generated telemetry code for normalized route labels, no secrets or unnecessary personal data in logs/traces/analytics, protected pprof endpoints, consent checks, and approved vendors or self-hosted backends.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The example instruments `r.URL.Path` directly as a Prometheus label, which creates unbounded metric cardinality from user-controlled request paths. In a production observability skill, this is dangerous because it can cause memory growth, slow Prometheus queries, and monitoring outages or blind spots under normal or adversarial traffic.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The examples advertise `path` and `endpoint` labels without clearly constraining them to normalized route templates, while later guidance says full URLs and unbounded paths must never be used. In this context, readers are likely to copy these labels literally, introducing high-cardinality series that can degrade or crash the metrics backend.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The counter examples and dashboard queries promote aggregation `by (path)` and top-k path views, reinforcing a per-path metric design that conflicts with the document's own cardinality warning. Because this skill is meant for production observability, such contradictory guidance is especially risky: developers may deploy metrics that allow path explosion from dynamic IDs or attacker-generated URLs.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The guidance encourages attaching structured attributes like user_id and order_id to traces and suggests transmitting/logging correlated observability data, but it does not include clear guardrails about avoiding personal data, secrets, tokens, request bodies, or regulated identifiers in spans. In an observability skill focused on production instrumentation, this omission is risky because trace data is routinely exported to third-party backends, retained broadly, and accessed by many operators, increasing the chance of privacy violations and sensitive-data exposure.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.