📦

Audit History

golang-pro - 5 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v5 Latest	Aug 7, 2026, 09:42 AM	No confirmed findings	0	No capability change
v4	Jul 6, 2026, 02:49 PM	No confirmed findings	0	No capability change
v3	Jul 6, 2026, 02:49 PM	No confirmed findings	0	No capability change
v2	Jun 30, 2026, 04:03 AM	No confirmed findings	5	Contains scriptsExternal commandsNetwork accessFilesystem accessEnv variables
v1	Feb 7, 2026, 08:45 AM	No confirmed findings	0	Baseline

Audit version 5 Latest

Aug 7, 2026, 09:42 AM

All 64 static detections are false positives caused by Go examples, Markdown formatting, Makefile snippets, configuration tags, or documentation links. No executable scripts, data exfiltration intent, or prompt injection evidence was found in the six scanned files.

Files scanned

2,261

Lines analyzed

Review items

False positives ignored

Risk Factors

⚡ Contains scripts (9)

references/concurrency.md:8-13 references/interfaces.md:79-82 references/project-structure.md:135-138 references/project-structure.md:406-409 references/project-structure.md:424-429 references/project-structure.md:45-46 references/project-structure.md:51-52 references/testing.md:339-343 references/testing.md:377-380

🌐 Network access (4)

references/interfaces.md:270 references/project-structure.md:438 SKILL.md:6 SKILL.md:124

⚙️ External commands (37)

📁 Filesystem access (2)

references/project-structure.md:58 references/project-structure.md:392

🔑 Env variables (1)

references/project-structure.md:445

Audited by: codex

Audit version 4

Jul 6, 2026, 02:49 PM

All static findings are false positives caused by Go, Makefile, and Markdown examples in reference documentation. I found no prompt injection, credential exfiltration intent, hidden command execution, or malicious network behavior.

Files scanned

2,221

Lines analyzed

Review items

False positives ignored

Risk Factors

⚡ Contains scripts (9)

🌐 Network access (3)

references/interfaces.md:270 references/project-structure.md:438 SKILL.md:6

⚙️ External commands (32)

📁 Filesystem access (2)

references/project-structure.md:58 references/project-structure.md:392

🔑 Env variables (1)

references/project-structure.md:445

Audited by: codex

Audit version 3

Jul 6, 2026, 02:49 PM

Files scanned

2,221

Lines analyzed

Review items

False positives ignored

Risk Factors

⚡ Contains scripts (9)

🌐 Network access (3)

references/interfaces.md:270 references/project-structure.md:438 SKILL.md:6

⚙️ External commands (32)

📁 Filesystem access (2)

references/project-structure.md:58 references/project-structure.md:392

🔑 Env variables (1)

references/project-structure.md:445

Audited by: codex

Audit version 2

Jun 30, 2026, 04:03 AM

Static analysis reported many command, script, network, filesystem, and environment patterns, but review found them inside markdown reference examples. No runnable skill code, prompt injection attempt, credential exfiltration, or hidden malicious behavior was found. The remaining risk is low because users may copy operational command examples into their own projects.

Files scanned

2,221

Lines analyzed

Review items

False positives ignored

Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

references/concurrency.md:5-13 references/generics.md:436-441 references/testing.md:442-450 SKILL.md:47-51

Markdown Backticks Flagged as Command Execution

The analyzer treated markdown fences and inline command text as executable Ruby or shell backticks. These locations are documentation examples, not skill runtime code.

The cited lines are markdown code fences, tables, or inline examples. I found no executable script wrapper or instruction to run hidden commands.

Low

references/concurrency.md:8-13 references/interfaces.md:79-82 references/project-structure.md:424-429 references/testing.md:339-343

Go Import Blocks Flagged as Dynamic Imports

Static script findings point to Go import blocks in reference snippets. They do not load code dynamically in the skill environment.

The syntax is ordinary Go sample code embedded in markdown. There is no JavaScript import expression or variable-based module loader.

Low

references/project-structure.md:243-317 references/project-structure.md:382-386 references/testing.md:440-450

Build Command Examples Require User Judgment

The references include Makefile, go test, go generate, Docker, and profiling examples. They are legitimate Go workflow documentation, but users should inspect commands before copying them.

The commands are normal Go build and test examples, not hidden automation. Some commands can affect local files if copied into a project, so a low-risk warning is appropriate.

Low

SKILL.md:6 references/interfaces.md:270 references/project-structure.md:438

Network Indicators Are Documentation Examples

The hardcoded URL and host values are a repository metadata URL and sample server addresses. They do not indicate outbound network behavior by the skill.

The cited URL is author metadata, and the host values are sample configuration defaults. No code sends data to those locations.

Low

references/interfaces.md:283-285 references/project-structure.md:150-152 references/project-structure.md:397 references/testing.md:78 SKILL.md:66

System Reconnaissance Alerts Are Identifier Examples

The system reconnaissance alerts point to ordinary Go sample identifiers and test data. They do not inspect the host system or gather environment details.

The cited lines are interface methods, user test fixtures, or section text. I found no commands such as uname, whoami, env dumping, or host enumeration.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

references/project-structure.md:58 references/project-structure.md:392 references/project-structure.md:445 references/project-structure.md:452

Example Paths and Environment Names Are Not Exfiltration

Relative paths and environment variable names appear in module and configuration examples. They demonstrate Go project layout and envconfig usage, not secret harvesting or traversal.

The path and environment references are inside isolated examples. I found no network sink, file reader, or instruction that collects secrets.

Low

SKILL.md:3 SKILL.md:30 SKILL.md:36 SKILL.md:48 references/interfaces.md:1 references/project-structure.md:392 references/project-structure.md:468 references/testing.md:440

Weak Crypto Alerts Are False Positives

The cited weak-cryptography locations do not contain cryptographic algorithms. They are headings, markdown examples, or Go project tooling text.

Search did not find md5, sha1, or similar cryptographic code in the reviewed content. The static hits appear to be substring or markdown-context errors.

Risk Factors

⚡ Contains scripts (9)

⚙️ External commands (159)

🌐 Network access (3)

references/interfaces.md:270 references/project-structure.md:438 SKILL.md:6

📁 Filesystem access (2)

references/project-structure.md:58 references/project-structure.md:392

🔑 Env variables (1)

references/project-structure.md:445

Audited by: codex

Audit version 1

Feb 7, 2026, 08:45 AM

Documentation skill with legitimate Go programming patterns. All 195 static findings are false positives triggered by code examples in markdown files. No malicious intent detected.

Files scanned

2,221

Lines analyzed

Review items

False positives ignored

Static false positives ignored (5)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Medium

SKILL.md:47-51 references/concurrency.md:5-285 references/generics.md:5-441 references/interfaces.md:5-374 references/project-structure.md:5-476 references/testing.md:5-450

Documentation Code Examples Detected as Shell Commands

Static analyzer flagged shell command syntax in markdown documentation as 'Ruby/shell backtick execution'. These are legitimate Go build commands and tooling examples (e.g., go mod init, go build) within code blocks, not executable malicious code.

All flagged patterns are Go code examples within markdown documentation blocks. No actual shell execution occurs - these are instructional examples for Go tooling.

Medium

references/concurrency.md:8-13 references/interfaces.md:79-82 references/project-structure.md:135-429 references/testing.md:339-380

Dynamic Import Patterns in Documentation

Static analyzer detected 'Dynamic import() expression' patterns in documentation files. These are TypeScript/JavaScript code examples within markdown documentation, not actual executable code.

Patterns are code examples within markdown documentation blocks, not actual dynamic imports in executable code.

Medium

references/interfaces.md:270 references/project-structure.md:438 SKILL.md:6

Network Patterns in Documentation

Static analyzer detected hardcoded IP addresses and network patterns. These are network configuration examples in documentation, not actual network code.

Hardcoded IPs are example values in documentation, not actual network code or credential exfiltration.

Medium

references/project-structure.md:58 references/project-structure.md:392

Filesystem Patterns in Documentation

Static analyzer detected path traversal sequences and filesystem access patterns. These are file path examples and project structure documentation, not actual path traversal exploits.

Path patterns are legitimate project structure examples showing directory layouts, not exploitable path traversal.

Medium

references/project-structure.md:445

Environment Access Patterns in Documentation

Static analyzer detected database connection string patterns. These are configuration examples showing best practices for environment-based configuration.

Database configuration examples demonstrate proper secret management practices using environment variables.

No confirmed security findings were recorded for this completed audit.

Audited by: claude

← Back to Skill