Security audit

Golang Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This is mostly a Go advice guide, but it asks for command execution and includes automatic network troubleshooting that is not clearly user-controlled.

Install only if you are comfortable with the agent having command execution available for Go code checks. Before use, treat the skill as advisory by default and do not allow automatic ping, firewall, proxy, or retry diagnostics unless you explicitly ask for troubleshooting.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill claims to be a pure Markdown advisory tool with no extra operational requirements, yet elsewhere it instructs automatic network diagnostics and command retries. This mismatch can mislead users and agents into executing unnecessary system/network commands, expanding behavior beyond a documentation-only Go best-practices guide.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The skill is presented as a Go pitfalls and best-practices guide, but it defines broad operational patterns such as create/modify/delete/import/save/export. In an agentic environment, these generic action verbs can be interpreted as permission to perform side-effecting operations unrelated to the stated educational purpose, increasing the risk of unintended file or system changes.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Including ping, firewall, and proxy checks is unjustified for a Go language guidance skill and introduces unnecessary network/system interaction. In a tool-enabled agent, this can trigger external connectivity probes or environment inspection that users did not intend when requesting coding advice.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The activation wording is broad and natural-language driven, which can cause the skill to trigger on loosely related requests. In an agent context, ambiguous invocation increases the chance that operational sections of the skill are applied when the user only wanted passive Go advice.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The declared capability coverage is overly broad, keyword-driven, and underspecified, extending beyond a focused Go pitfalls guide. Such vague scope makes it easier for an agent to over-apply the skill and justify unrelated actions, especially when combined with exec permission and generic operation modes.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The Markdown explicitly describes automatic execution of network diagnostics and retries without clear warning or user approval. Automatic command execution is dangerous in a skill whose expected role is educational guidance, because it can cause unintended network activity and host inspection.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.