Go modules · proxy.golang.org

github.com/curling-ai/picoclaw

Shipped Live Secret, Tls Verification Disabled, Remote Payload +1 more

Why PkgRadar flagged v0.0.0-20260807163425-b672dcaf6207

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.0.0-20260807163425-b672dcaf6207`	High risk	81	2026-08-08
`v0.0.0-20260806221429-cc6edd9143b8`	High risk	81	2026-08-07
`v0.0.0-20260806175641-ae44ec90f8ae`	High risk	81	2026-08-07
`v0.0.0-20260805211504-82e11e8b7630`	High risk	81	2026-08-06
`v0.0.0-20260805174122-4459249c5fc4`	High risk	81	2026-08-06
`v0.0.0-20260805034126-8fb0432eafa9`	High risk	81	2026-08-06
`v0.0.0-20260730124348-4a50d9d4e17b`	High risk	81	2026-07-31
`v0.0.0-20260730115236-40ad8be4e0e0`	High risk	81	2026-07-31
`v0.0.0-20260728213311-ad34dfe1d9b7`	High risk	81	2026-07-29
`v0.0.0-20260728200439-d39b213f9761`	High risk	81	2026-07-29
`v0.0.0-20260728022208-e88e02e2d3b7`	High risk	81	2026-07-29
`v0.0.0-20260727224451-dd4000681385`	High risk

Block this in CI

PkgRadar gates github.com/curling-ai/picoclaw (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/curling-ai/[email protected]