Correct. But you didn't see that the source was one level up in the directory tree from the untrustworthy binary blob?

* https://github.com/kaushikgopal/dotfiles/blob/master/bin/usb...

Presumably there is a sensible way to do this in go by calling an API and getting the original machine-readable data rather than shelling out to run an entire sub-process for a command-line command and parsing its human-readable (even JSON) output. Especially as it turns out that the command-line command itself runs another command-line command in its turn. StackExchange hints at looking to see what API the reporter tool under /System/Library/SystemProfiler actually queries.