ClawHub
Back to skill

Security audit

Go

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only Go development assistant skill with broad but disclosed agent capabilities and no hidden installer, persistence, or exfiltration behavior in the artifact.

Install only if you are comfortable letting the agent read Go code, optionally write changes, run development commands, and use any configured LLM/API service. Review command plans before execution and avoid using it on repositories containing secrets unless your agent environment prevents secret disclosure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The skill claims that risky code and external dependencies were removed, yet it still advertises exec capability and external API usage elsewhere in the document. This creates a misleading trust signal that may cause users or agents to underestimate the operational risk of running commands or sending data externally.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill advertises file writing, command execution, and external API integration without prominent user-facing warnings about filesystem changes, command side effects, or data egress. In an agent environment, these capabilities can lead to unauthorized local changes or unintended disclosure of source code, secrets, or other sensitive data if invoked too broadly.

Static analysis

No suspicious patterns detected.