golang-swagger

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:35 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent Go Swagger documentation helper; its main risk is installing the third-party swag CLI using a mutable latest version.

Install only if you are comfortable allowing the agent to edit Go project files and run the swag/go tooling. Prefer pinning the swag CLI to a specific reviewed version instead of @latest, and run it in a repository-scoped environment without unnecessary secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20 and SKILL.md:37
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

yaml

install:
  - kind: go
    package: github.com/swaggo/swag/cmd/swag@latest
    bins: [swag]

markdown

**Dependencies:**

- swag: `go install github.com/swaggo/swag/cmd/swag@latest`

Technical Analysis

The Skill installs the swag executable from the mutable @latest version of a third-party Go module. The package name corresponds to the declared Swagger tooling and there is no evidence that the current upstream package is malicious. However, using @latest means the effective executable can change after this Skill has been reviewed.

This creates a supply-chain trust gap: every installation automatically selects the version currently resolved as latest rather than a specific, reviewed release. Although downloading and compiling an ordinary Go command does not itself run the resulting command, this Skill permits and recommends subsequent swag execution. A compromised or malicious future release would therefore execute when the generated binary is invoked.

Attack Path

1. An attacker compromises the upstream repository, release process, module publisher, or a dependency incorporated into a future swag release.
2. The compromised release becomes the version resolved by github.com/swaggo/swag/cmd/swag@latest.
3. A user or Skill harness follows the installation metadata or documented command.
4. Go downloads and compiles the mutable release into a local swag executable.
5. The Skill invokes swag init, swag fmt, or another allowed swag command.
6. The compromised executable runs with the privileges and filesystem/network access of the user or agent process.

This path depends on an upstream supply-chain compromise; no such compromise was identified in the audited files.

Impact Assessment

A mal ...[truncated 762 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest in both installation locations with a specific reviewed semantic version:

   yaml

   install:
     - kind: go
       package: github.com/swaggo/swag/cmd/swag@vX.Y.Z
       bins: [swag]
   

   markdown

   - swag: `go install github.com/swaggo/swag/cmd/swag@vX.Y.Z`
   

2. Keep the metadata and documentation versions synchronized so users cannot inadvertently bypass the pinned version.

3. Review release notes, source changes, transitive dependencies, and known vulnerabilities before updating the pin.

4. Perform version updates through a controlled dependency-review process rather than automatically tracking the latest release.

5. Retain Go module checksum verification and use a trusted module proxy or an organization-controlled dependency mirror where appropriate.

6. Run the CLI in a least-privilege environment with access limited to the target repository and without unnecessary credentials or sensitive environment variables.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.