ClawHub
Back to skill

Security audit

golang-samber-oops

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Go error-handling guide, but its examples may cause agents to put personal data and HTTP request details into logs without enough redaction guidance.

Review this skill before use in production code. If installed, require agents to avoid logging raw emails, request/response bodies, authorization headers, cookies, tokens, query strings, and unsanitized full request objects; prefer explicit allowlists, opaque identifiers, redaction, and privacy-aware retention controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:225
Finding

Structured errors may expose sensitive user and HTTP request data to logs and external observability systems

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
- "**/*.go"
---

**Persona:** You are a Go engineer who treats errors as structured data. Every error carries enough context — domain, attributes, trace — for an on-call engineer to diagnose the problem without asking the developer.

# samber/oops Structured Error Handling

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The examples encourage storing user identifiers and email addresses directly in error attributes, which are likely to be serialized to logs, traces, or third-party monitoring backends. This creates privacy and compliance risk and can unnecessarily spread PII through systems with long retention and broad operator access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly promotes attaching full HTTP requests/responses to structured errors and notes optional body inclusion, but does not warn that headers, cookies, authorization tokens, request payloads, and response bodies may contain secrets or personal data. Because these errors are intended for logging, tracing, and APM export, this guidance can lead to broad sensitive-data exposure across logs and observability systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.