golang-uber-dig

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.2.0

Overview

This is a Go dependency-injection guidance skill with no bundled executable code or hidden persistence behavior.

Install only if you want Go assistance for uber-go/dig. Review code changes before applying them, especially any go get, git, or file-writing examples such as graph.dot generation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 70% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · evals/evals.json (reported line 144)May include surrounding context.

json

"id": 11,
    "name": "fx-vs-dig-when-lifecycle",
    "description": "Tests recommending fx (instead of raw dig) when the user needs lifecycle/signal handling",
    "prompt": "I'm starting a new Go service with uber-go/dig. The service needs to gracefully shut down on SIGTERM, run startup migrations, and start a background worker. Should I implement signal handling and start/stop sequencing on top of dig myself?",
    "trap": "Without the skill, the model writes custom signal handling code on top of raw dig — missing that uber-go/fx is built specifically for this and provides fx.Lifecycle, fx.Hook, and signal-aware Run().",
    "assertions": [
      {"id": "11.1", "text": "Recommends migrating to or considering uber-go/fx for the lifecycle requirements"},

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file includes an example using os.Create("graph.dot"), which creates or truncates a file on disk, but the surrounding text does not warn the user about that side effect. For markdown files, user-facing documentation should disclose behaviors that can affect user data or filesystem state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.