Security audit

Go安全质量检查免费版

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a normal Go vulnerability-scanning skill, but it also includes broad triggers and dependency-changing commands that can modify a project without clear opt-in.

Install only if you want an agent to run Go security and quality commands in a project. Treat the dependency-update snippets as manual remediation steps: review the exact command, commit or back up `go.mod` and `go.sum` first, and avoid using the broad trigger wording for non-Go or general security tasks.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as a vuln-scanning tool, but its documented workflows extend into building, testing, vetting, and other operational actions. This scope expansion can cause an agent or user to invoke commands with side effects they would not reasonably expect from a read-oriented security scan skill.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill includes dependency-changing commands such as `go get -u ./...` and `go mod tidy`, which can rewrite project state and pull new code from external sources. In an agent context, these side effects are materially riskier than passive vulnerability detection because they can alter builds, introduce supply-chain changes, and break reproducibility without explicit approval.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger conditions are broad enough to activate the skill for generic security, compliance, quality, or crypto-related requests beyond its real capability. In agent systems, overbroad activation increases the chance the wrong tool is selected and that commands are run in contexts where dependency changes, builds, or scans are inappropriate.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The description's broad 'Use when' guidance overstates the skill's scope and may cause it to be used for unrelated security tasks. In a tool-using agent, ambiguous scope is dangerous because it can route user requests to an exec-capable skill that performs unintended actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation presents dependency-modifying commands without a clear warning that they alter project files and dependency state. This is dangerous because users or agents may treat the skill as informational, while it can silently rewrite `go.mod`/`go.sum`, fetch new packages, and change build behavior.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The installation and scan steps rely on network access to fetch tools, resolve modules, and contact vulnerability data sources, but this is not clearly surfaced where commands are introduced. In restricted or sensitive environments, hidden network behavior can violate policy or surprise users, especially when invoked by an agent.

Static analysis

No suspicious patterns detected.