Security audit

Go安全漏洞扫描免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Go vulnerability-scanning guide with some dependency-update examples that users should run deliberately.

Install this only for Go projects where you are comfortable letting an agent run govulncheck and related Go commands. Treat scan commands as low risk, but review and explicitly approve any go get, go mod tidy, build, or test step because those can change dependency files and pull newer upstream code.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill includes `go get -u ./...` and `go mod tidy` in an example flow, which modifies project dependencies and repository files despite being presented primarily as a scanning/evaluation tool. In an agent context with `exec` capability, this can cause unintended dependency drift, build changes, or supply-chain exposure if run without explicit user confirmation.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The `safe_go_update` function performs package updates, `go mod tidy`, builds, tests, and a rollback attempt, all of which mutate the project and may pull unreviewed upstream code. In an automated agent setting, presenting this under 'best practices' without strong safeguards increases the risk of unapproved changes and unreliable rollback behavior.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger conditions are broad ('security detection, compliance audit, vulnerability scanning, encryption protection'), which can cause the skill to activate in contexts beyond its actual capability. In an agent environment, ambiguous activation increases the chance that `exec`-based commands run when the user intended advisory-only help or a different security task.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation includes file-modifying commands (`go get -u ./...`, `go mod tidy`) without a prominent warning that they will change `go.mod`, `go.sum`, and potentially transitive dependency resolution. In an agent-driven workflow, omission of this warning can lead to silent project mutation and unexpected supply-chain or stability consequences.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The best-practice workflow performs dependency updates and cleanup without explicitly warning the user about project file changes or the risks of pulling new upstream code. Because the skill has `exec` capability, this creates a realistic path to unintended repository modification under the guise of routine security maintenance.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.