ClawHub
Back to skill

Security audit

golang-safety

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly normal Go safety guidance, but it asks for broader repository and agent powers than its purpose clearly needs.

Install only if you are comfortable granting this skill broad repository-level Git command access and agent delegation. Prefer a version that narrows Git to read-only inspection commands or clearly documents when mutating Git operations and delegation may occur.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:17
Finding

Overly Broad Git and Agent Tool Permissions Violate Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Affected code:

yaml
allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent

Technical Analysis

The Skill grants unrestricted access to all Git subcommands through Bash(git:*) and permits delegation through Agent. Its documented purpose is to provide defensive Go coding guidance and review Go source files. Unrestricted Git operations and general Agent delegation are broader than necessary for that purpose.

The Git wildcard may authorize commands that modify repository configuration, hooks, branches, remotes, and working-tree content or push changes using credentials already available in the environment. Agent delegation may further expand the available operational scope beyond the explicitly listed Go review tools. This creates a least-privilege violation: malicious or prompt-injected task content could influence the model to invoke capabilities unrelated to Go safety analysis.

No evidence was found that the Skill currently executes malicious Git commands, accesses credentials, establishes persistence, or exfiltrates data. The risk arises from the excessive capabilities exposed by its configuration.

Attack Path

  1. The Skill is loaded for a Go code review or editing task.
  2. Attacker-controlled content in a source file, task description, or other reviewed input supplies instructions designed to influence the agent.
  3. The agent follows those instructions and invokes an unnecessary command allowed by Bash(git:*), such as altering repository configuration, changing remotes, modifying branches, or pushing commits.
  4. Alternatively, the agent delegates work through Agent, potentially broadening execution beyond the narrowly documented review workflow.
  5. The operation affects the local repository or, where credentials and network ac ...[truncated 519 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove Bash(git:*) and Agent unless a documented workflow demonstrates that they are necessary.
  • Retain only capabilities directly required for Go safety review, such as Read, Glob, Grep, and narrowly scoped go or golangci-lint commands.
  • Grant Edit and Write only when the Skill is explicitly expected to modify source files.
  • If Git inspection is required, replace the wildcard with a strict allowlist of read-only commands, such as git status, git diff, and git log.
  • Explicitly prohibit mutating and remote Git operations, including git push, git config, git remote set-url, hook modification, destructive reset or clean operations, and credential-related commands.
  • Avoid general-purpose agent delegation, or constrain delegated agents to the same minimal tool policy and repository scope.
  • Add tests that verify prompt content cannot cause tool calls outside the documented Go analysis workflow.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/evals.json (reported line 336)May include surrounding context.

json
"name": "nil-pointer-receiver-guard",
    "description": "Guards against nil *Notifier before calling methods that dereference the receiver",
    "prompt": "In package `notify`, write a struct `Notifier` with a `webhook string` field. Add a `Send(msg string) error` method that formats and would send the message (just return nil for now). Then write a function `NotifyAll(n *Notifier, messages []string) error` that sends each message using n.Send. Return the first error.",
    "trap": "Model calls n.Send without checking n == nil — calling a method on a nil pointer panics when the method accesses n.webhook",
    "assertions": [
      {
        "id": "14.1",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/evals.json (reported line 831)May include surrounding context.

json
"name": "nil-pointer-receiver-guard",
    "description": "Guards against nil *Notifier before calling methods that dereference the receiver",
    "prompt": "In package `notify`, write a struct `Notifier` with a `webhook string` field. Add a `Send(msg string) error` method that formats and would send the message (just return nil for now). Then write a function `NotifyAll(n *Notifier, messages []string) error` that sends each message using n.Send. Return the first error.",
    "trap": "Model calls n.Send without checking n == nil — calling a method on a nil pointer panics when the method accesses n.webhook",
    "assertions": [
      {
        "id": "14.1",

Static analysis

No suspicious patterns detected.