ClawHub
Back to skill

Security audit

GoPlus安全扫描免费版

Security checks across malware telemetry and agentic risk

Overview

This is a basic Go security-scanning skill with no embedded executable code, though its documentation is vague about inputs and optional callbacks.

Install only if you are comfortable with an agent reading and running scanner commands in the target Go project. Verify the GoPlus CLI source yourself, avoid providing a callback URL unless you intend scan metadata to leave your machine, and do not place secrets in scan inputs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description is framed for broadly any 'security-related' development scenario and lacks narrow activation criteria or scope boundaries. In an agent ecosystem, this can cause the skill to be invoked in situations beyond simple local code scanning, increasing the chance it is applied to sensitive tasks or mixed with unrelated instructions in ways that expand data exposure or unsafe execution.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The input field accepts generic 'input data or instructions,' which is overly ambiguous for a security scanning skill. Combined with the declared exec capability, this ambiguity may lead an agent to treat arbitrary user instructions as in-scope operational commands, creating opportunity for misuse, unintended command execution, or processing of sensitive content beyond scanning.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documented callback_url parameter implies scan results may be sent to an external endpoint, but there is no warning, trust boundary description, or consent requirement. Because scan findings can contain file paths, code snippets, dependency details, and vulnerability metadata, this creates a clear exfiltration risk if a malicious or mistaken callback URL is supplied.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.