go-vuln-info-disclosureUse when auditing Go code involving logging, error handling, HTTP response data, Kubernetes Secret management, or credential storage. Covers CWE-200/532/522/...
Install via ClawdBot CLI:
clawdbot install yhy0/go-vuln-info-disclosureGrade Limited — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
/etc/passwdAI Analysis
The skill is a static detection guide for auditing Go code vulnerabilities; it contains no executable code, runtime instructions, or mechanisms to send data. The 'external URL' signal is a false positive from a grep pattern example within the detection strategy text.
Audited Apr 18, 2026 · audit v1.0
Generated Mar 21, 2026
Auditing a Go-based microservices application deployed on Kubernetes, focusing on logging and error handling to prevent exposure of database credentials and API tokens in production logs. This scenario is common in fintech or healthcare industries where sensitive data must be protected under regulations like GDPR or HIPAA.
Evaluating tools like Argo CD or Rancher for information disclosure risks, such as cluster secrets leaking in API responses or logs during deployment workflows. This scenario targets organizations using CI/CD pipelines in tech or e-commerce sectors to ensure secure automation.
Analyzing Go services within a service mesh (e.g., Istio) to detect sensitive data in HTTP responses and error messages that could expose user tokens or internal configurations. Relevant for SaaS companies handling multi-tenant data in cloud environments.
Reviewing containerized Go applications for log exposure of Kubernetes Secrets or environment variables, especially in logging frameworks like logrus or zap. This scenario applies to logistics or manufacturing industries using IoT devices with embedded Go code.
Scanning popular Go libraries for vulnerabilities like missing json:"-" tags in structs that could lead to credential leaks when serialized. This scenario is critical for cybersecurity firms or large enterprises relying on third-party dependencies in their software supply chain.
Offering specialized audits for Go applications to identify and remediate information disclosure vulnerabilities, targeting clients in regulated industries. Revenue is generated through project-based fees and retainer contracts for ongoing security assessments.
Providing a cloud platform that automatically scans Go codebases for patterns like %+v formatting or K8s Secret exposures, with subscription plans for developers and DevOps teams. Revenue comes from monthly or annual subscriptions, with tiered pricing based on scan frequency and codebase size.
Developing courses and certifications focused on Go security best practices, including hands-on labs for detecting information disclosure issues. Revenue is generated through course sales, workshop fees, and certification exams for IT professionals and software engineers.
💬 Integration Tip
Integrate this skill into CI/CD pipelines using grep commands from the detection strategy to automate scans during code commits, ensuring early detection of vulnerabilities before deployment.
Scored Apr 19, 2026
YouTube Data API integration with managed OAuth. Search videos, manage playlists, access channel data, and interact with comments. Use this skill when users want to interact with YouTube. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway).
Trello API integration with managed OAuth. Manage boards, lists, cards, members, and labels. Use this skill when users want to interact with Trello for project management. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway).
Fetch up-to-date library documentation via Context7 API. Use PROACTIVELY when: (1) Working with ANY external library (React, Next.js, Supabase, etc.) (2) User asks about library APIs, patterns, or best practices (3) Implementing features that rely on third-party packages (4) Debugging library-specific issues (5) Need current documentation beyond training data cutoff Always prefer this over guessing library APIs or using outdated knowledge.
API reference for CoinMarketCap DEX endpoints including token lookup, pools, transactions, trending, and security analysis. Use this skill whenever the user...
Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture. Invoke for resource modeling, versioning strategies, pagination patterns, error handling standards.
Lightweight API mock server for prototyping and testing, supporting JSON/JSON Schema responses, dynamic data, validation, latency, and webhook simulation.