ClawHub
Back to skill

Security audit

Go安全缺陷检测

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a Go vulnerability-checking guide, but it gives broad triggers and dependency-changing commands without clear user confirmation.

Use this only on authorized Go projects. Run govulncheck first in a read-only assessment mode, review any proposed dependency updates, and inspect go.mod/go.sum changes before accepting remediation. Do not rely on the API key, callback, paid-service, or automation claims unless the publisher provides real supporting implementation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The skill advertises automated Go vulnerability detection and remediation, but the only concrete implementation shown for the 'core implementation logic' is a placeholder echo command. This can mislead agents or users into trusting nonexistent security scanning or fixes, creating a false sense of protection and potentially leaving real vulnerabilities unaddressed.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
Labeling a placeholder echo command as the 'core implementation logic' is deceptive and may cause downstream automation or users to assume security checks were performed when they were not. In a security skill, this mismatch is more dangerous because users may rely on false scan results to make risk decisions.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The invocation guidance is overly broad, including generic 'security detection', 'compliance audit', 'quality check', and even 'encryption protection' scenarios beyond the skill's demonstrated scope. This can cause the agent to invoke the skill in inappropriate contexts and potentially run repository-modifying or security-relevant commands where they are not justified.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill recommends commands like 'go get -u', 'go mod tidy', and 'go mod edit -replace' that modify project dependencies and repository state, but it does not provide a prominent upfront warning about side effects. In an exec-enabled skill, this increases the chance an agent will alter source code or dependency graphs without informed user consent, potentially breaking builds or introducing supply-chain risk.

Static analysis

No suspicious patterns detected.