ClawHub
Back to skill

Security audit

golang-samber-oops

Security checks across malware telemetry and agentic risk

Overview

This Go error-handling skill is coherent, but its examples can lead agents to put personal data, HTTP request details, and raw input payloads into errors that are commonly logged or exported.

Install only if you are comfortable reviewing generated error-handling code for data exposure. Prefer opaque user IDs over emails, avoid attaching raw request/response bodies or sensitive headers, and sanitize payloads before they are stored in error context or sent to logs/APM systems.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples explicitly encourage attaching user identifiers and email addresses to structured errors, which can propagate into logs, APM systems, traces, and incident tooling. In a skill about reusable error-handling patterns, this normalizes collection of PII without any guardrails on minimization, redaction, or environment-specific controls.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Documenting `.Request(req, includeBody)` and `.Response(res, includeBody)` without a strong warning can lead users to capture headers, cookies, authorization tokens, session identifiers, and request/response bodies in error objects. Because this skill promotes structured errors as portable diagnostic artifacts, the leaked data may spread broadly across logs and observability backends.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The panic recovery example stores raw input data in error context, which may expose secrets, personal data, or proprietary payloads during the most failure-prone path in the system. Panic-recovery errors are especially likely to be exported verbosely for troubleshooting, increasing the chance of sensitive-data disclosure.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.