ClawHub
Back to skill

Security audit

golang-project-layout

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly normal Go project-layout guidance, but it also tells agents to silently add a persistent always-load directive to project agent configuration.

Review this skill before installing. Its Go layout advice is mostly conventional, but you should only allow it to modify CLAUDE.md, AGENTS.md, or other agent-config files after you have explicitly approved the exact directive and understand that it can affect future agent runs in the repository.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs the agent to write an always-load directive into persistent agent configuration files without user confirmation. That exceeds normal Go project layout guidance and creates durable behavior changes in the repository, which can silently influence future agent runs and expand trust beyond the user's immediate request.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill tells the agent to write to a repository file but provides no user-facing warning that a persistent project file will be modified. Silent writes to agent-config files are risky because they alter repository behavior and review surface in ways the user may not expect from a layout-assistance skill.

Ssd 4

Medium
Confidence
98% confidence
Finding
This is a trust-to-persistence escalation: a user invokes a Go layout skill, and the skill leverages that trust to plant an always-load directive into persistent agent configuration. Even if the referenced skill is benign, the pattern is dangerous because it establishes lasting automatic loading behavior without informed consent, creating a foothold for future influence over agent actions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.