Security audit

GoPlus安全扫描

Security checks for vulnerabilities and agentic risk

Overview

This is a Go security-scanning skill, but its broad activation language and underspecified execution/patrol behavior need review before installation.

Review this skill before installing. Use it only for explicit Go project security-scanning tasks, avoid giving it broad automation requests, do not configure webhooks unless you are comfortable sending scan summaries externally, and require clear user approval before any command execution or scheduled patrol is started.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Confidence: 91% confidence
Finding: The skill description uses very broad activation language such as improving efficiency, automating workflows, and batch processing, which overlaps with many ordinary user requests unrelated to security scanning. In an agent ecosystem, this can cause inappropriate invocation of a skill that has exec capability, expanding the chance that untrusted input is routed into command-executing behavior without clear user intent.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The installation guidance instructs users to invoke the skill in an AI Agent conversation with required parameters, but does not define clear activation constraints or safe invocation boundaries. Because the skill includes exec, ambiguous invocation guidance increases the risk of accidental triggering and misuse in contexts where shell execution or external scanning behavior was not explicitly intended.

Static analysis

No suspicious patterns detected.