ClawHub
Back to skill

Security audit

Go Lint 配置工具

Security checks across malware telemetry and agentic risk

Overview

This skill is a Go lint setup helper whose file-writing and command-running guidance is expected for creating golangci-lint configs, though its trigger wording is broader than ideal.

Install this only if you want an agent to help modify golangci-lint configuration in a Go repository and run local lint-related commands. Review proposed .golangci.yml changes before applying them, and keep the skill use focused on lint setup or troubleshooting rather than general coding or deployment work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

High
Confidence
80% confidence
Finding
The trigger condition is so broad that the skill may activate for generic coding, debugging, or deployment-related requests well beyond Go lint configuration. In a skill with exec and write capabilities, overbroad activation increases the chance of unintended command execution or file modification in irrelevant contexts.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill advertises read/exec/write tooling and instructs users to generate configuration and run commands, but it lacks a clear warning that these actions can modify repository files or execute shell commands on the host. In an agent environment, insufficient disclosure can lead to unsafe user consent and accidental destructive or environment-affecting operations.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.