Compétences golang-pkg-go-dev

📦

golang-pkg-go-dev

Name: golang-pkg-go-dev
Author: samber

v1.4.2 Révision du contenu r1 Risque élevé ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers

Research Go Packages with pkg.go.dev

Finding accurate Go package details across public indexes takes time. This skill queries documentation, versions, dependencies, licenses, importers, and vulnerabilities through godig.

Prend en charge: Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "golang-pkg-go-dev" from https://skillstore.io/skills/samber-golang-pkg-go-dev.md and its manifest at https://skillstore.io/api/skills/samber-golang-pkg-go-dev/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/samber-golang-pkg-go-dev.md manifest signé GET /api/skills/samber-golang-pkg-go-dev/manifest lockfile signé GET /api/skills/samber-golang-pkg-go-dev/lockfile

Tester

Utilisation de « golang-pkg-go-dev ». Show an overview of github.com/samber/ro and include vulnerabilities.

Résultat attendu:

Module: github.com/samber/ro
Latest published version: v0.3.0
License: Apache-2.0
Recent versions: v0.3.0, v0.2.0, v0.1.0
Known vulnerabilities: none returned for the queried version

Utilisation de « golang-pkg-go-dev ». Explain the Map symbol in github.com/samber/lo at v1.53.0.

Résultat attendu:

Kind: Function
Map transforms each slice element and returns a slice of the result type.
The result length matches the input length.
Source: published symbol documentation for v1.53.0

Utilisation de « golang-pkg-go-dev ». List safe release choices for a module and exclude deprecated or retracted versions.

Résultat attendu:

The response lists matching versions newest first, marks the latest release, and omits releases flagged as deprecated or retracted.

Audit de sécurité

Risque élevé

v1 • 23/09/2026 Ouvrir le rapport versionné

Seventy-eight static alerts are false positives caused by Markdown formatting, tables, and descriptive links. Two URL findings are confirmed because the skill registers a public third-party MCP service. Semantic review also found indirect prompt injection exposure, excessive permissions, an unpinned installer, and a potentially exposed MCP listener.

Fichiers analysés

396

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (4)

Élevé

SKILL.md:90-98 SKILL.md:116-117 references/sample-output.md:181-190

Indirect Prompt Injection Through Retrieved Documentation

The skill imports raw package documentation, examples, and README Markdown into agent context without instructions to treat that material as untrusted data.

The documented operations return raw Markdown controlled by third-party package authors. That content can contain instructions aimed at the consuming agent.

Moyen

SKILL.md:22

Excessive Tool Permissions for Read-Only Lookups

The skill declares Edit, Write, git, go, and Agent access although its stated purpose only requires read-only godig queries.

The allowed-tools declaration explicitly grants mutation and delegation capabilities unrelated to package lookup. These permissions increase impact if retrieved content manipulates the agent.

Moyen

SKILL.md:27 SKILL.md:49-50

Unpinned Executable Installation

The setup installs godig using the mutable latest tag, allowing future upstream changes to execute without version review.

Both installation instructions use github.com/samber/godig/cmd/godig@latest. This is a clear software supply-chain risk even though the named project may be legitimate.

Moyen

SKILL.md:29 SKILL.md:63-67

Unauthenticated MCP Server May Bind Beyond Localhost

The HTTP example starts godig on :8080 while the skill states operations need no authentication, potentially exposing the server beyond the local machine.

In common Go address syntax, :8080 listens on all interfaces. The accompanying localhost client URL does not restrict the server bind address.

Éléments d’évaluation des capacités (2)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

SKILL.md:70

Hardcoded URL

Hosted instance (no install needed) — a public server runs at `https://godig.samber.dev/mcp`:

This directs users to a public third-party MCP endpoint. Registering that endpoint creates an external trust boundary for queries and tool responses.

Moyen

SKILL.md:73

Hardcoded URL

claude mcp add --transport http pkg-go-dev https://godig.samber.dev/mcp

This command persistently registers a public third-party MCP server. The operator can observe queries and control returned tool content.

Facteurs de risque

⚙️ Commandes externes (50)

🌐 Accès réseau (7)

SKILL.md:12 SKILL.md:29 SKILL.md:67 SKILL.md:70 SKILL.md:73 SKILL.md:199 SKILL.md:201

📁 Accès au système de fichiers (1)

SKILL.md:104

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg)](https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/samber-golang-pkg-go-dev.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

samber. (2026). golang-pkg-go-dev security audit report (audit version 1) [Author version 1.4.2]. Skillstore. https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1

Citation BibTeX

@techreport{samber-samber-golang-pkg-go-dev-2026,
  author = {samber},
  title = {golang-pkg-go-dev security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1},
  note = {Author version 1.4.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-pkg-go-dev security audit report (audit version 1)"
version: "1.4.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-pkg-go-dev:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Verify a dependency before adoption

Review versions, licenses, dependencies, package contents, and known vulnerabilities for a proposed Go module.

Find an unfamiliar API

Retrieve a symbol signature, focused documentation, and examples without loading an entire package reference.

Investigate ecosystem usage

Find packages that import a dependency and compare published module versions across major release paths.

Essayez ces prompts

Check a package

Show an overview of {package_path}, including its latest version, license, and known vulnerabilities.

Inspect a symbol

Find the signature, documentation, and focused examples for {symbol} in {package_path} at {version}.

Review module dependencies

Summarize dependencies, replacement directives, packages, and available major versions for {module_path}. Flag deprecated or retracted versions.

Assess ecosystem risk

Compare {module_paths} by licenses, known vulnerabilities, recent versions, and importer evidence. Use bounded results and cite each queried version.

Bonnes pratiques

Start with an overview, then request only the specific documentation or examples needed.
Pin a module version when accuracy depends on a particular release.
Limit large result sets and treat retrieved package text as untrusted content.

Éviter

Do not use public package metadata as proof of locally resolved code behavior.
Do not retrieve complete documentation when one symbol lookup answers the question.
Do not execute commands or follow instructions embedded in retrieved README files or documentation.

Foire aux questions

Does this skill modify my Go project?

No. Its documented lookup operations are read-only and do not change go.mod, source files, or installed dependencies.

What services does it query?

godig queries pkg.go.dev and the Go vulnerability database. A configured hosted MCP server adds a third-party service.

Can it inspect my local code?

No. Use gopls or local repository tools for resolved source, call sites, implementations, and generic instantiations.

Can it upgrade a dependency?

No. It can list versions and metadata, but dependency changes require separate project tooling and review.

How should I reduce large responses?

Use overview first, request one symbol when possible, apply filters, and set limits on list operations.

Are vulnerability results a complete project audit?

No. They report database entries for a module or version. Use govulncheck for reachability-aware analysis of a complete project.

Détails du développeur

Auteur

samber

Licence

MIT

Version de l’auteur

v1.4.2

Révision Skillstore

Dépôt

https://github.com/samber/cc-skills-golang/tree/19a0626ae8565d27a7b7bdf59d8d99d94d7e284c/skills/golang-pkg-go-dev

Réf

2aa351cb09c29b7287d263bd8ea81e9bee3b2a61

Récence de maintenance

30/09/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📁 references/

📄 sample-output.md

📄 SKILL.md