ClawHub
Back to skill

Security audit

GoPlus安全扫描免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a basic Go security-scanning guide with some vague and inconsistent documentation, but no artifact-backed hidden, destructive, or exfiltrating behavior.

Before installing, treat scan reports as sensitive because they may reveal file paths and vulnerability details. Use the skill only on code you are authorized to scan, verify the real GoPlus CLI install command yourself, and avoid using any callback URL unless you know exactly what data will be sent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description repeatedly claims applicability to broad 'security-related' development scenarios without defining clear activation boundaries, inputs, or safety constraints. In an agent skill that exposes read and exec tools, vague triggering can cause the skill to be invoked in contexts beyond simple scanning, increasing the chance of over-collection, unintended execution paths, or misuse on sensitive codebases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents report export and detailed findings output, including file paths and vulnerability metadata, but does not warn that these artifacts may contain sensitive internal structure, secrets-adjacent context, or exploitable weakness details. If reports are shared, stored insecurely, or sent to callbacks/logs, they can leak information useful for follow-on attacks.

Content

No source excerpt is available for this finding.