Skip to content
skillsafebeta
← Report library
Purpose / Other

Golang Stay Updated Skill Security Audit

What the author says it does (original text)

Golang ecosystem watch list — official sources (go.dev/blog, pkg.go.dev, tour.golang.org, golang-nuts), newsletters (Golang Weekly, Awesome Go Newsletter), communities (r/golang, gophers.slack.com, Go Forum, go.dev/wiki), blogs (Dave Cheney, Ardan Labs, Rob Pike), YouTube channels (Gopher Academy, GopherCon EU/UK), conferences, and Go contributors to follow on GitHub, X and Bluesky. Use when seeki

Independent security check

Security risks found

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The resource directory requests unnecessary file-write, Git, and command-execution permissions

Source references: 4
What we found

The stated purpose is to provide Go news and learning resources, yet `allowed-tools` includes Edit, Write, Git and Go commands, plus Agent. The workflow shown in the body does not require modifying the user’s project or running development commands.

Why this matters

If the host treats this field as an authorization boundary, an agent using the Skill could modify project files, alter the Git working tree, or execute Go commands—effects well beyond consulting a resource list. These lines do not show that any command has actually run.

The Skill is a curated list of Go news sources and people to follow, yet it requests file editing/writing, Go, golangci-lint and Git command execution, plus Agent access. No workflow in the body shows why these capabilities are needed. If the host grants the declaration, invocation could expose the user's project to modification or Git operations beyond what resource recommendations require. A user can ask the author to limit it to read-only and necessary web-retrieval access, and disable writes and command execution in the host.

SKILL.md:2In the instructionsOpen original file
---name: golang-stay-updateddescription: "Golang ecosystem watch list — official sources (go.dev/blog, pkg.go.dev, tour.golang.org, golang-nuts), newsletters (Golang Weekly, Awesome Go Newsletter), communities (r/golang, gophers.slack.com, Go Forum, go.dev/wiki), blogs (Dave Cheney, Ardan Labs, Rob Pike), YouTube channels (Gopher Academy, GopherCon EU/UK), conferences, and Go contributors to follow on GitHub, X and Bluesky. Use when seeking Golang learning resources, discovering new libraries or tools, finding community channels or meetups, picking Go people to follow, or keeping up with Go language changes and releases. Not for querying a specific module's versions, docs, or vulnerabilities from the CLI (→ See `samber/cc-skills-golang@golang-pkg-go-dev` skill)."user-invocable: true
Show 3 other places
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch WebSearch---
SKILL.md:3In the instructionsOpen original file
name: golang-stay-updateddescription: "Golang ecosystem watch list — official sources (go.dev/blog, pkg.go.dev, tour.golang.org, golang-nuts), newsletters (Golang Weekly, Awesome Go Newsletter), communities (r/golang, gophers.slack.com, Go Forum, go.dev/wiki), blogs (Dave Cheney, Ardan Labs, Rob Pike), YouTube channels (Gopher Academy, GopherCon EU/UK), conferences, and Go contributors to follow on GitHub, X and Bluesky. Use when seeking Golang learning resources, discovering new libraries or tools, finding community channels or meetups, picking Go people to follow, or keeping up with Go language changes and releases. Not for querying a specific module's versions, docs, or vulnerabilities from the CLI (→ See `samber/cc-skills-golang@golang-pkg-go-dev` skill)."user-invocable: true
SKILL.md:24In the instructionsOpen original file
A curated guide to keeping your finger on the pulse of the Go ecosystem.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The author recommends themself and makes that recommendation an evaluation requirement without disclosing the relationship

Source references: 4
What we found

The metadata identifies the author as `samber`; the recommendation table lists Samuel Berthe (`samber`) as a library author to follow; and the evaluation explicitly requires mentioning Samuel Berthe and his projects. The recommendation does not disclose that this is the Skill’s own author, making the self-promotion hard for users to recognize.

Why this matters

The model may present the author as an independently selected priority, steering users’ attention, visits, or adoption decisions toward the author and their projects. The evidence does not establish payment or malicious projects.

The metadata identifies the author as samber, the recommendation list includes Samuel Berthe / samber, and the evaluation makes naming him and his projects an explicit pass condition. The supplied text does not disclose beside that recommendation that he is the Skill's author. This could make self-promotion appear to be an independent curated judgment and influence whom users follow or which projects they consider. Users can ask for a prominent affiliation disclosure and for evaluations that do not require recommending the author.

SKILL.md:7In the instructionsOpen original file
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.metadata:  author: samber  version: "1.3.1"  openclaw:
Show 3 other places
SKILL.md:92In the instructionsOpen original file
| --- | --- | --- | --- | --- || **Steve Francia** | spf13 | @spf13 | <https://linkedin.com/in/spf13> |  || **Samuel Berthe** | samber | @samuelberthe | <https://linkedin.com/in/samuelberthe> | <https://bsky.app/profile/samber.bsky.social> || **Mitchell Hashimoto** | mitchellh | @mitchellh | <https://linkedin.com/in/mitchellh> | <https://bsky.app/profile/mitchellh.com> || **Matt Holt** | mholt | @mholt6 |  |  || **Tomás Senart** | tsenart | @tsenart | <https://www.linkedin.com/in/tsenart/> |  |
evals/evals.json:61In the instructionsOpen original file
    "id": 5,    "name": "go-library-authors-to-follow",    "description": "Tests knowledge of influential Go library/framework authors",    "prompt": "I want to follow Go developers who create popular libraries and frameworks. Who should I follow on GitHub or X?",    "trap": "Without the skill, the model may list only a few well-known names, missing the breadth of the ecosystem",    "assertions": [      {"id": "5.1", "text": "Mentions Steve Francia (spf13) — Cobra, Viper, Hugo"},      {"id": "5.2", "text": "Mentions Mitchell Hashimoto (mitchellh) — Terraform, Consul, Vault"},      {"id": "5.3", "text": "Mentions Samuel Berthe (samber) — lo, do, oops"},      {"id": "5.4", "text": "Mentions Matt Holt (mholt) — Caddy"},      {"id": "5.5", "text": "Provides GitHub usernames or X handles for the recommended people"}    ]
evals/evals.json:66In the instructionsOpen original file
    "assertions": [      {"id": "5.1", "text": "Mentions Steve Francia (spf13) — Cobra, Viper, Hugo"},      {"id": "5.2", "text": "Mentions Mitchell Hashimoto (mitchellh) — Terraform, Consul, Vault"},      {"id": "5.3", "text": "Mentions Samuel Berthe (samber) — lo, do, oops"},      {"id": "5.4", "text": "Mentions Matt Holt (mholt) — Caddy"},      {"id": "5.5", "text": "Provides GitHub usernames or X handles for the recommended people"}    ]

Inside this skill

7 instruction sections

The Skill’s actual content is a static directory of Go ecosystem resources, including official sites, communities, people, blogs, and video channels. Its body does not instruct the agent to run commands, modify files, install software, or make Git changes.

View source
SKILL.md:22In the instructionsOpen original file
# Stay Updated with GoA curated guide to keeping your finger on the pulse of the Go ecosystem.
SKILL.md:129In the instructionsOpen original file
## Quick Tips for Staying Updated1. **Subscribe to 1-2 newsletters** - Don't overload yourself2. **Follow 10-20 key people** on X/Bluesky who post regularly3. **Check Go.dev/blog weekly** for official announcements4. **Join Go Slack** for real-time discussions5. **Bookmark pkg.go.dev** to discover new libraries — → See `samber/cc-skills-golang@golang-pkg-go-dev` skill to query a module's latest versions, docs, and vulnerabilities from the CLI6. **Attend a GopherCon** (virtual or in-person) yearly

The accompanying evaluations mainly test whether the model repeats particular recommendations from the directory, including newsletters, communities, people, and channels. These are test assertions, not runtime commands.

View source
evals/evals.json:4In the instructionsOpen original file
    "id": 1,    "name": "go-newsletters-recommendation",    "description": "Tests whether the model recommends specific Go newsletters for staying updated",    "prompt": "I want to stay updated with Go ecosystem news without spending hours browsing. What newsletters should I subscribe to?",    "trap": "Without the skill, the model may give generic advice like 'follow blogs' or only mention the official blog, missing curated newsletters",    "assertions": [      {"id": "1.1", "text": "Recommends Golang Weekly (golangweekly.com)"},      {"id": "1.2", "text": "Recommends Awesome Go Newsletter (go.libhunt.com)"},      {"id": "1.3", "text": "Advises subscribing to 1-2 newsletters to avoid overload"},      {"id": "1.4", "text": "Mentions these provide curated content, articles, and library updates"},      {"id": "1.5", "text": "Does not recommend more than 3-4 newsletters (quality over quantity)"}    ]
Start here · InstructionsSKILL.md
golang-stay-updated
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "📰"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:40In the instructionsOpen original file
| --- | --- | --- || **Golang Weekly** | Weekly curated Go content, news, and articles | <https://golangweekly.com/> || **Awesome Go Newsletter** | Updates on new Go libraries and tools | <https://go.libhunt.com/> |
SKILL.md:41In the instructionsOpen original file
| **Golang Weekly** | Weekly curated Go content, news, and articles | <https://golangweekly.com/> || **Awesome Go Newsletter** | Updates on new Go libraries and tools | <https://go.libhunt.com/> |
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch WebSearch---
Lines read
284
File checksum (to compare versions)
e5b1752d6df589cb286bc21facdab7df93ec27651a9772ae05ef9d2797d2e6e2