📦

golang-security

Name: golang-security
Author: samber

v1.2.2 Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen

Review Go Code for Security Risks

Go services can expose sensitive data through unsafe input handling, weak authentication, and insecure configuration. This skill guides structured reviews, threat modeling, and mitigation planning.

Unterstützt: Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "golang-security" from https://skillstore.io/skills/samber-golang-security.md and its manifest at https://skillstore.io/api/skills/samber-golang-security/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/samber-golang-security.md Signiertes manifest GET /api/skills/samber-golang-security/manifest Signiertes lockfile GET /api/skills/samber-golang-security/lockfile

Testen

„golang-security“ wird verwendet. Review a handler that inserts a request name directly into a SQL query.

Erwartetes Ergebnis:

Finding: SQL injection through a request-controlled name.
Impact: An attacker could change query logic and access unauthorized records.
Recommendation: Pass the name as a query parameter rather than concatenating it.
Verification: Add a regression test with SQL metacharacters and confirm the input remains data.

„golang-security“ wird verwendet. Threat-model a webhook receiver that stores events and publishes queue messages.

Erwartetes Ergebnis:

Spoofing and tampering: Verify webhook signatures and enforce a replay policy.
Denial of service: Limit request sizes, processing time, and submission rates.
Information disclosure: Protect transport connections and exclude secrets from logs.
Repudiation: Record event identifiers and processing outcomes in structured audit logs.

Sicherheitsaudit

Hohes Risiko

v1 • 15.10.2026 Versionsbericht öffnen

All 152 static alerts are false positives involving defensive examples, evaluation fixtures, documentation formatting, or unrelated keyword combinations. No evidence found of credential exfiltration or prompt injection targeting this audit. Two semantic findings identify unsafe XSS guidance and incomplete SSRF defenses that could introduce vulnerabilities into generated applications.

Gescannte Dateien

3,702

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

SKILL.md:92

Unsafe HTML Template Recommendation

The XSS quick reference lists text/template alongside html/template as an auto-escaping defense. text/template does not escape HTML, so following this recommendation can introduce XSS when rendering untrusted data.

The quick-reference row explicitly recommends both packages for auto-escaping. The detailed injection guide correctly uses html/template, confirming a contradictory security recommendation.

Hoch

references/injection.md:280-296

Incomplete SSRF Mitigation Presented As Safe

The example marked Good checks URL properties but provides no redirect revalidation or connection-time address enforcement. With a normal HTTP client, redirects or DNS changes can bypass preliminary destination checks and reach internal services.

The recommended snippet contains only preliminary URL checks and an undefined isInternalIP helper. No client transport or redirect policy enforces the destination when a connection occurs.

Risikofaktoren

⚙️ Externe Befehle (38)

🌐 Netzwerkzugriff (18)

evals/evals.json:175 evals/evals.json:175 evals/evals.json:164 evals/evals.json:174 evals/evals.json:175 evals/evals.json:280 evals/evals.json:501 references/network.md:66 references/network.md:73 references/network.md:76 references/network.md:203 references/third-party.md:63 SKILL.md:12 SKILL.md:188 SKILL.md:189 SKILL.md:190 SKILL.md:191 SKILL.md:165

📁 Dateisystemzugriff (9)

evals/evals.json:53 evals/evals.json:570 evals/evals.json:423 evals/evals.json:423 evals/evals.json:403 evals/evals.json:405 references/filesystem.md:29 references/filesystem.md:180 references/injection.md:189

🔑 Umgebungsvariablen (10)

references/secrets.md:30 references/secrets.md:31 references/secrets.md:57 references/secrets.md:58 references/secrets.md:190 references/secrets.md:90 references/secrets.md:92 references/secrets.md:104 references/secrets.md:106 references/secrets.md:31

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/samber-golang-security/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-security/security.svg)](https://skillstore.io/skills/samber-golang-security?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/samber-golang-security?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-security/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/samber-golang-security.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

samber. (2026). golang-security security audit report (audit version 1) [Author version 1.2.2]. Skillstore. https://skillstore.io/skills/samber-golang-security/audits/1

BibTeX-Zitat

@techreport{samber-samber-golang-security-2026,
  author = {samber},
  title = {golang-security security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-security/audits/1},
  note = {Author version 1.2.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-security security audit report (audit version 1)"
version: "1.2.2"
type: report
authors:
  - name: "samber"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/samber-golang-security/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-security:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Review a Go Pull Request

Trace changed handlers and adjacent data flows to identify exploitable input, authorization, and configuration risks.

Audit a Service

Organize a codebase review by vulnerability domain and prioritize findings with evidence and remediation recommendations.

Model System Threats

Map trust boundaries across APIs, databases, queues, and external integrations before choosing security controls.

Diese Prompts ausprobieren

Check One Handler

Review [handler] for security risks. Explain untrusted inputs, existing protections, and recommended fixes. Do not modify files.

Review a Pull Request

Review [pull request or diff] for security issues. Trace relevant call sites and validation. Report evidence, exploitability, severity, and focused remediation.

Design Secure File Access

Design secure file serving for [service] using Go [version]. Address traversal, symlinks, permissions, resource limits, and regression tests. Explain remaining assumptions.

Audit Trust Boundaries

Audit [repository] across injection, cryptography, web security, authorization, and concurrency. Apply STRIDE and DREAD. Separate exploitable findings from hardening recommendations. Propose verification tests.

Bewährte Praktiken

Provide relevant code, deployment context, Go version, and trust boundaries before requesting a review.
Validate recommendations against current library behavior and distinguish demonstrated exploits from optional hardening.
Verify each mitigation with focused regression tests and appropriate static, race, or fuzz testing.

Vermeiden

Treating instructional snippets or generated fixes as production-ready without independent review.
Sharing live credentials, private keys, or unnecessary personal data in review prompts.
Equating keyword matches or severity scores with proven exploitability.

Häufig gestellte Fragen

Which assistants can use this skill?

The skill declares compatibility with Codex and Claude Code. It provides instructions and reference documents rather than a separate executable application.

Does this skill automatically scan my code?

It guides an assistant through reviews and documents scanner commands. Actual scanning depends on available tools, project access, and user authorization.

What Go versions do the examples target?

Filesystem examples prefer os.Root on Go 1.24 or newer. Older-version alternatives are included, with limitations for symlink resistance.

Are all recommendations safe to copy directly?

No. The XSS quick reference incorrectly includes text/template, and the SSRF example needs redirect and connection controls. Review examples before use.

Can it help prioritize vulnerabilities?

Yes. It describes STRIDE threat analysis and DREAD scoring, alongside data-flow tracing and evidence-based review workflows.

Does it replace dependency management or CI configuration?

No. It references govulncheck and verification commands, but delegates comprehensive dependency management and CI integration to related skills.