golang-pkg-go-dev

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.4.0

Overview

The skill is mainly a Go package documentation helper, but it requests broader local edit, git, Go, and agent powers than its read-only purpose requires.

Review before installing. The godig lookup behavior is coherent and read-only, but the skill grants more local authority than it appears to need. Prefer pinning godig to a reviewed version, avoid the hosted MCP endpoint for sensitive/private package queries, and consider narrowing tool permissions to godig-only use if your harness supports it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party CLI Installation via Mutable Latest Version

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19 (repeated in installation instructions at SKILL.md:31-36)
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code

markdown

**Dependencies:** `godig` — `go install github.com/samber/godig/cmd/godig@latest` (or use a registered godig MCP server / the hosted instance instead).

The installation section repeats the unsafe command:

markdown

### Install

```bash
go install github.com/samber/godig/cmd/godig@latest

text

### Technical Analysis

The Skill instructs users to install the `godig` executable using the mutable Go version selector `@latest`. This does not bind the installed executable to the version that was available when the Skill was reviewed.

If the upstream repository, maintainer account, module publishing process, or a future release is compromised, `@latest` can resolve to attacker-controlled code. The resulting package is compiled and installed as a local executable. The Skill subsequently permits broad invocation through `Bash(godig:*)`, and the executable may also be launched as an MCP server.

The repository path does not appear to be a typosquatted dependency, and the audit found no evidence that the current upstream package is malicious. The risk arises from automatically trusting mutable future releases.

### Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its release process.
2. The attacker publishes a malicious version that becomes the version resolved by `@latest`.
3. A user follows the Skill's installation instructions:
   ```bash
   go install github.com/samber/godig/cmd/godig@latest
   ```
4. Go downloads and compiles the attacker-controlled source, installing it as the user's `godig` executable.
5. The Skill or user invokes the executable through `godig` CLI commands or starts it as an MCP server.
6. The malicious executable 
...[truncated 730 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a specifically reviewed semantic version:

   bash

   go install github.com/samber/godig/cmd/godig@v0.2.0
   

2. Update the pinned version only after reviewing release notes, source changes, ownership changes, and published security advisories.
3. Where stronger supply-chain assurance is required, document the expected module checksum from go.sum or independently verify the release source and commit.
4. Avoid automatically installing or upgrading the executable during normal Skill invocation.
5. Run the tool with least privilege and restrict access to unnecessary credentials, sensitive directories, and network resources.
6. Apply the same version pin consistently to every installation example in SKILL.md, including metadata and setup instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.