📦

golang-context

Name: golang-context
Author: samber

v1.3.1 Inhaltsrevision r1 Mittleres Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff

Improve Go Context Propagation and Cancellation

Broken context propagation leaves downstream work running after requests end. This skill guides context lifecycles across Go handlers, services, and databases.

Unterstützt: Codex Code(CC)

📊 70 Angemessen

Maintain this Skill? Claim it 📊 70 Angemessen

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "golang-context" from https://skillstore.io/skills/samber-golang-context.md and its manifest at https://skillstore.io/api/skills/samber-golang-context/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/samber-golang-context.md Signiertes manifest GET /api/skills/samber-golang-context/manifest Signiertes lockfile GET /api/skills/samber-golang-context/lockfile

Testen

„golang-context“ wird verwendet. Review a handler that creates Background before calling its repository and payment client.

Erwartetes Ergebnis:

The handler discards request cancellation by creating a new root context.
Pass the request context through service, database, and HTTP client calls.
Test that client cancellation reaches both downstream operations.

„golang-context“ wird verwendet. Review a repository transaction that starts with Begin but uses ExecContext for its updates.

Erwartetes Ergebnis:

Transaction creation does not receive the caller context.
Start the transaction with BeginTx and keep passing the caller context to statements.
Retain rollback cleanup and test cancellation during transaction startup.

„golang-context“ wird verwendet. Explain why an asynchronous audit event stops when its HTTP handler returns.

Erwartetes Ergebnis:

The goroutine inherits a request context that is canceled when the handler returns.
WithoutCancel preserves request values while removing cancellation and deadlines.
Add a finite timeout and shutdown ownership; detaching cancellation alone does not guarantee delivery.

Sicherheitsaudit

Mittleres Risiko

v1 • 15.10.2026 Versionsbericht öffnen

All 49 static findings are false positives caused by Markdown formatting, Go identifiers, metadata, or illustrative evaluation fixtures. No evidence found of prompt injection, credential theft, system reconnaissance, or unauthorized command execution. One semantic risk remains: the background audit example removes cancellation and deadlines without bounding its goroutine lifetime.

Gescannte Dateien

608

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

references/cancellation.md:177-180

Detached Audit Work Has No Lifetime Bound

The recommended audit goroutine uses context.WithoutCancel without a replacement timeout or shutdown signal. Blocked audit calls can accumulate goroutines and connections across requests.

WithoutCancel removes the inherited deadline and cancellation signal, and the example supplies no replacement bound. Resource exhaustion depends on the audit implementation and request volume.

Risikofaktoren

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/samber-golang-context/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-context/security.svg)](https://skillstore.io/skills/samber-golang-context?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/samber-golang-context?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-context/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/samber-golang-context.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

samber. (2026). golang-context security audit report (audit version 1) [Author version 1.3.1]. Skillstore. https://skillstore.io/skills/samber-golang-context/audits/1

BibTeX-Zitat

@techreport{samber-samber-golang-context-2026,
  author = {samber},
  title = {golang-context security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-context/audits/1},
  note = {Author version 1.3.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-context security audit report (audit version 1)"
version: "1.3.1"
type: report
authors:
  - name: "samber"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/samber-golang-context/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-context:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Review Request Cancellation

Find context propagation breaks between handlers, services, SQL queries, and downstream HTTP requests.

Investigate Work That Outlives Requests

Review cancellation ownership, timeout cleanup, and background goroutines that continue after client disconnection.

Standardize Request Metadata

Design typed context accessors and trace propagation conventions without hiding business inputs or infrastructure dependencies.

Diese Prompts ausprobieren

Choose the Right Context

Explain when to use Background, TODO, and r.Context in Go. Review this function: [function].

Review a Request Call Chain

Review this handler, service, and repository for broken context propagation: [code]. Identify missing context-aware calls and cancellation cleanup.

Design Timeouts and Metadata

Review this service flow: [code]. Propose nested timeout budgets and typed request metadata accessors while keeping dependencies explicit.

Bound Detached Audit Work

Review this asynchronous audit flow: [code]. Preserve trace values with WithoutCancel, add a finite timeout, and assess shutdown ownership and concurrency limits.

Bewährte Praktiken

Pass the caller context as the first parameter and use context-aware downstream APIs.
Release derived contexts on every path unless cancellation ownership is explicitly transferred.
Use typed metadata keys and give detached work an explicit timeout and lifecycle owner.

Vermeiden

Creating a new Background context inside a request call chain.
Using context values to hide database connections, configuration, or required business arguments.
Launching detached goroutines without lifetime limits or shutdown coordination.

Häufig gestellte Fragen

Which AI tools does this skill support?

The declared supported tools are Codex and Claude Code.

Which Go version do the newer context examples require?

WithoutCancel and AfterFunc require Go 1.21 or later. Other application APIs may require newer versions.

Does this skill automatically detect every context bug?

No. It provides guidance and evaluation scenarios, not a standalone analyzer. Compile changes, run tests, and use appropriate linters.

What belongs in context values?

Use request-scoped metadata such as trace IDs or authenticated identity. Keep infrastructure dependencies and business arguments explicit.

Can a child timeout extend its parent deadline?

No. The earlier deadline applies, so a child cannot extend the time remaining on its parent.

Does WithoutCancel guarantee background audit delivery?

No. It only detaches cancellation and deadlines while preserving values. Add a timeout and shutdown coordination; reliable delivery may require durable infrastructure.