ClawHub
Back to skill

Security audit

Go漏洞扫描基础版

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Go vulnerability-scanning helper that runs govulncheck and does not show hidden, destructive, or unrelated behavior.

Before installing, understand that govulncheck may contact external Go vulnerability or module services and may reveal module or dependency metadata. Use it on Go projects you are authorized to scan, and avoid running it in restricted environments without checking network policy.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill directs the agent to run govulncheck without clearly warning that the tool may contact external services to fetch vulnerability data. In an agent context, undisclosed outbound network access can leak repository/module metadata, surprise users in restricted environments, and violate privacy or compliance expectations even if the command is otherwise legitimate.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.