Golang Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This Go guidance skill is mostly a Markdown helper, but it asks for command execution and includes automatic network diagnostics that are not well scoped to its stated purpose.

Install only if you are comfortable with an agent using local command execution for Go validation. Treat any network diagnostics, ping commands, firewall/proxy inspection, or automatic retries as requiring explicit approval before they run.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:268

Finding

Unnecessary Automatic Network Diagnostics Through Execution Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:268
Vulnerability Type: Excessive tool permissions and automatic network probing
Risk Level: Medium

Vulnerable Configuration and Instruction

yaml

allowed-tools: read exec

text

- 执行ping命令测试网络连通性,检查防火墙和代理设置连接后重新执行命令机制: 失败时自动执行ping命令测试网络连通性,检查防火墙和代理设置连接后重新执行命令, 最多3次 - 处理方式: 按上述步骤操作并确认结果

The instruction at line 268 directs the agent to automatically execute ping, inspect firewall and proxy settings, reconnect, and retry up to three times after a failure.

Technical Analysis

The skill is presented as a Markdown-based Go programming guidance tool. Its legitimate functions involve reviewing Go code and explaining language pitfalls; they do not inherently require operating-system command execution, network probing, or inspection of host connectivity configuration.

Nevertheless, line 5 grants the broad exec tool, while line 268 directs the agent to invoke network diagnostics automatically. The instruction does not define an approved destination, constrain command arguments, require user confirmation, or specify a safe non-shell execution mechanism. This violates least-privilege principles and gives failure handling capabilities beyond the skill's declared purpose.

The document does not itself contain shell interpolation or a concrete attacker-controlled command template, so direct command injection is not proven. However, an implementation that derives the diagnostic destination or command arguments from user input could expose a command-injection surface. Even without injection, automatic probing can reveal whether internal or external systems are reachable and may expose local firewall or proxy configuration through the agent's output.

Attack Path

1. A user invokes the skill for a Go-related operation that fails or can be made to appear to fail.
2. The failure-handling instruction activates automatically.
3. Using ...[truncated 1649 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic ping, firewall inspection, proxy inspection, and reconnection behavior from the generic error-handling instructions.
2. Remove exec from allowed-tools if the skill is intended only to provide Go guidance and review source supplied by the user.
3. If execution is necessary to compile or test Go code, expose only narrowly scoped commands and separate code validation from network diagnostics.
4. Require explicit user approval before performing any network operation or examining host network configuration.
5. Restrict diagnostic destinations to validated hostnames or IP addresses from an explicit allowlist.
6. Invoke diagnostic programs directly with structured argument arrays rather than through a shell. Reject shell metacharacters, options, and unexpected argument forms.
7. Apply execution timeouts, output limits, retry limits, and process isolation.
8. Run permitted commands in a sandbox with minimal filesystem access, no sensitive environment variables, and restricted network access.
9. Redact internal addresses, proxy credentials, and sensitive configuration values from diagnostic output.
10. Replace the current automatic behavior with a passive error message explaining that the user may independently verify connectivity when relevant.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs automatic execution of ping and retry behavior during error handling, despite being an exec-enabled skill and without a strong user-facing warning or opt-in for command execution. This creates a real risk of unexpected local/network command execution, which can leak environment details, touch external hosts, or normalize silent tool use beyond the user's intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation cue is extremely broad ('activate when the user explicitly requests') and does not constrain what kinds of requests should trigger the skill, making it easier for an agent to invoke exec-capable behavior in contexts the user may not understand. In a skill that declares allowed-tools: read exec, vague activation increases the chance of unintended use and weakens user-consent boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The title, description, and overall instructions present the skill as Chinese-language only, and there is no indication that users may choose another language. This can violate language or locale flexibility expectations when the skill is not explicitly documented as requiring Chinese for a justified regional reason.

Content

No source excerpt is available for this finding.