ClawHub
Back to skill

Security audit

Go代码检查配置工具

Security checks for vulnerabilities and agentic risk

Overview

This is a simple Markdown-only Go linter configuration skill with some overbroad boilerplate, but no hidden code, persistence, or data exfiltration behavior.

Install only if you want an agent to help configure or troubleshoot golangci-lint in a Go project. Keep its activity scoped to the intended repository, review any generated configuration or commands before applying them, and do not rely on its broad security or compliance scoring as a formal audit.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The skill is presented as a narrowly scoped golangci-lint configuration helper, but the later documentation broadens into generic API integration, network communication, and command execution failure handling. This scope inflation can mislead an agent into granting broader tool use or performing operations unrelated to the declared purpose, increasing the risk of unexpected external access or unsafe execution paths.

Description-Behavior Mismatch

Low
Confidence
76% confidence
Finding
The declared output includes broad scoring, security compliance judgments, and improvement reporting that exceed a focused linter-configuration skill. Overstating capability can cause downstream systems or users to trust fabricated or non-deterministic security assessments, creating integrity and decision-making risk.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
Claims of CI/CD integration, dependency defect detection, batch code review, and complexity visualization materially exceed the stated golangci-lint configuration role. Such capability overreach can normalize unnecessary access to repositories, pipelines, or dependencies, which expands the operational attack surface beyond user expectations.

Static analysis

No suspicious patterns detected.