Habilidades golang-pkg-go-dev

📦

golang-pkg-go-dev

Name: golang-pkg-go-dev
Author: samber

v1.4.2 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos

Research Go Packages with pkg.go.dev

Finding accurate Go package details across public indexes takes time. This skill queries documentation, versions, dependencies, licenses, importers, and vulnerabilities through godig.

Compatible con: Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "golang-pkg-go-dev" from https://skillstore.io/skills/samber-golang-pkg-go-dev.md and its manifest at https://skillstore.io/api/skills/samber-golang-pkg-go-dev/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/samber-golang-pkg-go-dev.md Manifest firmado GET /api/skills/samber-golang-pkg-go-dev/manifest Lockfile firmado GET /api/skills/samber-golang-pkg-go-dev/lockfile

Pruébalo

Usando "golang-pkg-go-dev". Show an overview of github.com/samber/ro and include vulnerabilities.

Resultado esperado:

Module: github.com/samber/ro
Latest published version: v0.3.0
License: Apache-2.0
Recent versions: v0.3.0, v0.2.0, v0.1.0
Known vulnerabilities: none returned for the queried version

Usando "golang-pkg-go-dev". Explain the Map symbol in github.com/samber/lo at v1.53.0.

Resultado esperado:

Kind: Function
Map transforms each slice element and returns a slice of the result type.
The result length matches the input length.
Source: published symbol documentation for v1.53.0

Usando "golang-pkg-go-dev". List safe release choices for a module and exclude deprecated or retracted versions.

Resultado esperado:

The response lists matching versions newest first, marks the latest release, and omits releases flagged as deprecated or retracted.

Auditoría de seguridad

Riesgo alto

v1 • 23/9/2026 Abrir el informe versionado

Seventy-eight static alerts are false positives caused by Markdown formatting, tables, and descriptive links. Two URL findings are confirmed because the skill registers a public third-party MCP service. Semantic review also found indirect prompt injection exposure, excessive permissions, an unpinned installer, and a potentially exposed MCP listener.

Archivos escaneados

396

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (4)

Alto

SKILL.md:90-98 SKILL.md:116-117 references/sample-output.md:181-190

Indirect Prompt Injection Through Retrieved Documentation

The skill imports raw package documentation, examples, and README Markdown into agent context without instructions to treat that material as untrusted data.

The documented operations return raw Markdown controlled by third-party package authors. That content can contain instructions aimed at the consuming agent.

Medio

SKILL.md:22

Excessive Tool Permissions for Read-Only Lookups

The skill declares Edit, Write, git, go, and Agent access although its stated purpose only requires read-only godig queries.

The allowed-tools declaration explicitly grants mutation and delegation capabilities unrelated to package lookup. These permissions increase impact if retrieved content manipulates the agent.

Medio

SKILL.md:27 SKILL.md:49-50

Unpinned Executable Installation

The setup installs godig using the mutable latest tag, allowing future upstream changes to execute without version review.

Both installation instructions use github.com/samber/godig/cmd/godig@latest. This is a clear software supply-chain risk even though the named project may be legitimate.

Medio

SKILL.md:29 SKILL.md:63-67

Unauthenticated MCP Server May Bind Beyond Localhost

The HTTP example starts godig on :8080 while the skill states operations need no authentication, potentially exposing the server beyond the local machine.

In common Go address syntax, :8080 listens on all interfaces. The accompanying localhost client URL does not restrict the server bind address.

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:70

Hardcoded URL

Hosted instance (no install needed) — a public server runs at `https://godig.samber.dev/mcp`:

This directs users to a public third-party MCP endpoint. Registering that endpoint creates an external trust boundary for queries and tool responses.

Medio

SKILL.md:73

Hardcoded URL

claude mcp add --transport http pkg-go-dev https://godig.samber.dev/mcp

This command persistently registers a public third-party MCP server. The operator can observe queries and control returned tool content.

Factores de riesgo

⚙️ Comandos externos (50)

🌐 Acceso a red (7)

SKILL.md:12 SKILL.md:29 SKILL.md:67 SKILL.md:70 SKILL.md:73 SKILL.md:199 SKILL.md:201

📁 Acceso al sistema de archivos (1)

SKILL.md:104

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg)](https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/samber-golang-pkg-go-dev.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

samber. (2026). golang-pkg-go-dev security audit report (audit version 1) [Author version 1.4.2]. Skillstore. https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1

Cita BibTeX

@techreport{samber-samber-golang-pkg-go-dev-2026,
  author = {samber},
  title = {golang-pkg-go-dev security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1},
  note = {Author version 1.4.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-pkg-go-dev security audit report (audit version 1)"
version: "1.4.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-pkg-go-dev:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Verify a dependency before adoption

Review versions, licenses, dependencies, package contents, and known vulnerabilities for a proposed Go module.

Find an unfamiliar API

Retrieve a symbol signature, focused documentation, and examples without loading an entire package reference.

Investigate ecosystem usage

Find packages that import a dependency and compare published module versions across major release paths.

Prueba estos prompts

Check a package

Show an overview of {package_path}, including its latest version, license, and known vulnerabilities.

Inspect a symbol

Find the signature, documentation, and focused examples for {symbol} in {package_path} at {version}.

Review module dependencies

Summarize dependencies, replacement directives, packages, and available major versions for {module_path}. Flag deprecated or retracted versions.

Assess ecosystem risk

Compare {module_paths} by licenses, known vulnerabilities, recent versions, and importer evidence. Use bounded results and cite each queried version.

Mejores prácticas

Start with an overview, then request only the specific documentation or examples needed.
Pin a module version when accuracy depends on a particular release.
Limit large result sets and treat retrieved package text as untrusted content.

Evitar

Do not use public package metadata as proof of locally resolved code behavior.
Do not retrieve complete documentation when one symbol lookup answers the question.
Do not execute commands or follow instructions embedded in retrieved README files or documentation.

Preguntas frecuentes

Does this skill modify my Go project?

No. Its documented lookup operations are read-only and do not change go.mod, source files, or installed dependencies.

What services does it query?

godig queries pkg.go.dev and the Go vulnerability database. A configured hosted MCP server adds a third-party service.

Can it inspect my local code?

No. Use gopls or local repository tools for resolved source, call sites, implementations, and generic instantiations.

Can it upgrade a dependency?

No. It can list versions and metadata, but dependency changes require separate project tooling and review.

How should I reduce large responses?

Use overview first, request one symbol when possible, apply filters, and set limits on list operations.

Are vulnerability results a complete project audit?

No. They report database entries for a module or version. Use govulncheck for reachability-aware analysis of a complete project.

Detalles del desarrollador

Autor

samber

Licencia

MIT

Versión del autor

v1.4.2

Revisión de Skillstore

Repositorio

https://github.com/samber/cc-skills-golang/tree/19a0626ae8565d27a7b7bdf59d8d99d94d7e284c/skills/golang-pkg-go-dev

Ref.

2aa351cb09c29b7287d263bd8ea81e9bee3b2a61

Actualidad del mantenimiento

30/9/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📁 references/

📄 sample-output.md

📄 SKILL.md