ClawHub
Back to skill

Security audit

Go漏洞扫描基础版

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Go vulnerability-scanning skill that uses govulncheck on a Go project and does not show hidden persistence, credential handling, or data exfiltration behavior.

Install only if you want an agent to run local Go security scan commands on a project you choose. Review the exact govulncheck and go install commands before approving them, since installation and vulnerability database checks may access the network.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill instructs the agent to execute govulncheck and install tooling via go install without explicit warnings that these actions run local commands and may access the network. In an agent context with exec capability, this can lead to unintended command execution, downloading external code or vulnerability data, and scanning user-selected paths without informed consent.

Static analysis

No suspicious patterns detected.