analyzing-golang-malware-with-ghidra

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill's scripts search for and print "suspicious" strings such as "key", "token", and "password" from binaries, which would require the agent to output any discovered secret values verbatim (exfiltration risk).

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The URL https://go-re.tk/about/ is hosted on a non-standard .tk domain (not an official vendor/CDN) and stands out from the other reputable sources, making it a higher-risk distribution point that could be used to host unofficial tool binaries or payloads.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow ingests outsider-authored free text from the analyzed Go binary itself (e.g., extracted strings/function names/URLs/dependencies decoded from arbitrary bytes) into the agent’s runtime context via scripts/agent.py/scripts/process.py and then into printed/JSON report text.