Habilidades golang-security

📦

golang-security

Name: golang-security
Author: samber

v1.2.2 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Review Go Code for Security Risks

Go services can expose sensitive data through unsafe input handling, weak authentication, and insecure configuration. This skill guides structured reviews, threat modeling, and mitigation planning.

Compatible con: Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "golang-security" from https://skillstore.io/skills/samber-golang-security.md and its manifest at https://skillstore.io/api/skills/samber-golang-security/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/samber-golang-security.md Manifest firmado GET /api/skills/samber-golang-security/manifest Lockfile firmado GET /api/skills/samber-golang-security/lockfile

Pruébalo

Usando "golang-security". Review a handler that inserts a request name directly into a SQL query.

Resultado esperado:

Finding: SQL injection through a request-controlled name.
Impact: An attacker could change query logic and access unauthorized records.
Recommendation: Pass the name as a query parameter rather than concatenating it.
Verification: Add a regression test with SQL metacharacters and confirm the input remains data.

Usando "golang-security". Threat-model a webhook receiver that stores events and publishes queue messages.

Resultado esperado:

Spoofing and tampering: Verify webhook signatures and enforce a replay policy.
Denial of service: Limit request sizes, processing time, and submission rates.
Information disclosure: Protect transport connections and exclude secrets from logs.
Repudiation: Record event identifiers and processing outcomes in structured audit logs.

Auditoría de seguridad

Riesgo alto

v1 • 15/10/2026 Abrir el informe versionado

All 152 static alerts are false positives involving defensive examples, evaluation fixtures, documentation formatting, or unrelated keyword combinations. No evidence found of credential exfiltration or prompt injection targeting this audit. Two semantic findings identify unsafe XSS guidance and incomplete SSRF defenses that could introduce vulnerabilities into generated applications.

Archivos escaneados

3,702

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

SKILL.md:92

Unsafe HTML Template Recommendation

The XSS quick reference lists text/template alongside html/template as an auto-escaping defense. text/template does not escape HTML, so following this recommendation can introduce XSS when rendering untrusted data.

The quick-reference row explicitly recommends both packages for auto-escaping. The detailed injection guide correctly uses html/template, confirming a contradictory security recommendation.

Alto

references/injection.md:280-296

Incomplete SSRF Mitigation Presented As Safe

The example marked Good checks URL properties but provides no redirect revalidation or connection-time address enforcement. With a normal HTTP client, redirects or DNS changes can bypass preliminary destination checks and reach internal services.

The recommended snippet contains only preliminary URL checks and an undefined isInternalIP helper. No client transport or redirect policy enforces the destination when a connection occurs.

Factores de riesgo

⚙️ Comandos externos (38)

🌐 Acceso a red (18)

evals/evals.json:175 evals/evals.json:175 evals/evals.json:164 evals/evals.json:174 evals/evals.json:175 evals/evals.json:280 evals/evals.json:501 references/network.md:66 references/network.md:73 references/network.md:76 references/network.md:203 references/third-party.md:63 SKILL.md:12 SKILL.md:188 SKILL.md:189 SKILL.md:190 SKILL.md:191 SKILL.md:165

📁 Acceso al sistema de archivos (9)

evals/evals.json:53 evals/evals.json:570 evals/evals.json:423 evals/evals.json:423 evals/evals.json:403 evals/evals.json:405 references/filesystem.md:29 references/filesystem.md:180 references/injection.md:189

🔑 Variables de entorno (10)

references/secrets.md:30 references/secrets.md:31 references/secrets.md:57 references/secrets.md:58 references/secrets.md:190 references/secrets.md:90 references/secrets.md:92 references/secrets.md:104 references/secrets.md:106 references/secrets.md:31

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/samber-golang-security/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-security/security.svg)](https://skillstore.io/skills/samber-golang-security?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/samber-golang-security?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-security/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/samber-golang-security.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

samber. (2026). golang-security security audit report (audit version 1) [Author version 1.2.2]. Skillstore. https://skillstore.io/skills/samber-golang-security/audits/1

Cita BibTeX

@techreport{samber-samber-golang-security-2026,
  author = {samber},
  title = {golang-security security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-security/audits/1},
  note = {Author version 1.2.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-security security audit report (audit version 1)"
version: "1.2.2"
type: report
authors:
  - name: "samber"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/samber-golang-security/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-security:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Review a Go Pull Request

Trace changed handlers and adjacent data flows to identify exploitable input, authorization, and configuration risks.

Audit a Service

Organize a codebase review by vulnerability domain and prioritize findings with evidence and remediation recommendations.

Model System Threats

Map trust boundaries across APIs, databases, queues, and external integrations before choosing security controls.

Prueba estos prompts

Check One Handler

Review [handler] for security risks. Explain untrusted inputs, existing protections, and recommended fixes. Do not modify files.

Review a Pull Request

Review [pull request or diff] for security issues. Trace relevant call sites and validation. Report evidence, exploitability, severity, and focused remediation.

Design Secure File Access

Design secure file serving for [service] using Go [version]. Address traversal, symlinks, permissions, resource limits, and regression tests. Explain remaining assumptions.

Audit Trust Boundaries

Audit [repository] across injection, cryptography, web security, authorization, and concurrency. Apply STRIDE and DREAD. Separate exploitable findings from hardening recommendations. Propose verification tests.

Mejores prácticas

Provide relevant code, deployment context, Go version, and trust boundaries before requesting a review.
Validate recommendations against current library behavior and distinguish demonstrated exploits from optional hardening.
Verify each mitigation with focused regression tests and appropriate static, race, or fuzz testing.

Evitar

Treating instructional snippets or generated fixes as production-ready without independent review.
Sharing live credentials, private keys, or unnecessary personal data in review prompts.
Equating keyword matches or severity scores with proven exploitability.

Preguntas frecuentes

Which assistants can use this skill?

The skill declares compatibility with Codex and Claude Code. It provides instructions and reference documents rather than a separate executable application.

Does this skill automatically scan my code?

It guides an assistant through reviews and documents scanner commands. Actual scanning depends on available tools, project access, and user authorization.

What Go versions do the examples target?

Filesystem examples prefer os.Root on Go 1.24 or newer. Older-version alternatives are included, with limitations for symlink resistance.

Are all recommendations safe to copy directly?

No. The XSS quick reference incorrectly includes text/template, and the SSRF example needs redirect and connection controls. Review examples before use.

Can it help prioritize vulnerabilities?

Yes. It describes STRIDE threat analysis and DREAD scoring, alongside data-flow tracing and evidence-based review workflows.

Does it replace dependency management or CI configuration?

No. It references govulncheck and verification commands, but delegates comprehensive dependency management and CI integration to related skills.