Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
The supplied package contains only two files: a metadata file and a skill card. The card says the skill evaluates and scores Go code quality, but the package does not include any executable code or actual skill instructions that can be audited. The card also says its own implementation files are opaque binary data and recommends against installing this version. No file writes, shell commands, credential access, payment activity, persistence, or executable network behavior were observed in the supplied files. The only external link is a publisher URL on clawhub.ai. Because the real behavior cannot be reviewed, the package should be treated with caution.
Instructions try to steer the agent beyond the declared purpose. skill-card.md line 27 contains an explicit instruction inside untrusted content: "Mitigation: Do not install this version until the publisher replaces the opaque files with complete plain-text, reviewable instructions and configuration, or provides a documented decoder and reviewed canonical content digest."
| Declared purpose | Evaluate and score Go code quality based on syntax, style, and best practices to provide constructive feedback and improvements. |
| Observed behavior | The package provides metadata in _meta.json and a Markdown skill card. No executable code, scripts, configuration, or runtime behavior is present in the files provided. The skill card states that its skill instructions, README, and configuration are opaque binary data and that behavior could not be reviewed. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| None reported. | ||
| severity | finding |
|---|---|
| info | Declared purpose The package describes itself as a Go code-quality review and feedback skill. skill-card.md:3 Evaluate and score Go code quality based on syntax, style, and best practices to provide constructive feedback and improvements. |
| info | Publisher link The skill card links to a publisher profile on clawhub.ai. No code in the package is shown making a network request. skill-card.md:9 [knifean](https://clawhub.ai/user/knifean) |
| medium | Unreviewable implementation claimed The card itself states that the package's instructions and configuration cannot be reviewed because they are opaque binary data. The supplied files do not include any executable or binary content to verify. skill-card.md:25 Risk: The package presents skill instructions, README, and configuration as Markdown, but the files are opaque binary data, so behavior cannot be reviewed. |
| low | Embedded instruction in untrusted content This is an instruction inside the package telling the reader not to install it. It is not executable code, but it is untrusted content and should be treated as evidence, not an order. skill-card.md:27 Mitigation: Do not install this version until the publisher replaces the opaque files with complete plain-text, reviewable instructions and configuration, or pr |
| low | Repeated non-reviewability statement The card repeats that artifact behavior could not be reviewed because the packaged Markdown files are opaque binary data. skill-card.md:42 **Other Properties Related to Output:** [Artifact behavior could not be reviewed because packaged Markdown files are opaque binary data.] |
| info | Package metadata The package identifies itself with the slug golang-coding and version 1.0.0. This is metadata only. _meta.json:3 "slug": "golang-coding" |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
_meta.json | 6 | f8b2e21ba9123b20… |
skill-card.md | 50 | 8e9b1e2e126a3361… |
Not read: config.md (binário, 5687 bytes), README.md (binário, 6655 bytes), SKILL.md (binário, 5367 bytes)
For agents
JSON: https://agenteconomy.report/k/golang-coding.audit.json · badge: https://agenteconomy.report/k/golang-coding.audited.svg ·
skill rating: /k/golang-coding · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).