ClawHub
Back to skill

Security audit

go-dev

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Go development skill with expected setup commands and no hidden or deceptive behavior.

Before installing, review network-fetched installer commands and prefer pinned package-manager or verified release installs when possible. Use migration commands only against the intended database, since DATABASE_URL can point at sensitive environments and some reference examples can revert or drop schema state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The reference recommends `curl -sSfL ... | sh`, which executes a network-fetched script directly in the shell without an opportunity to inspect or verify its contents first. If the remote host, CDN path, or transport chain is compromised, users could execute arbitrary code on their development machine; the lack of any warning or verification guidance makes the documentation materially unsafe.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.