📦

golang-security

Name: golang-security
Author: samber

v1.2.2 Révision du contenu r1 Risque élevé ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement

Review Go Code for Security Risks

Go services can expose sensitive data through unsafe input handling, weak authentication, and insecure configuration. This skill guides structured reviews, threat modeling, and mitigation planning.

Prend en charge: Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "golang-security" from https://skillstore.io/skills/samber-golang-security.md and its manifest at https://skillstore.io/api/skills/samber-golang-security/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/samber-golang-security.md manifest signé GET /api/skills/samber-golang-security/manifest lockfile signé GET /api/skills/samber-golang-security/lockfile

Tester

Utilisation de « golang-security ». Review a handler that inserts a request name directly into a SQL query.

Résultat attendu:

Finding: SQL injection through a request-controlled name.
Impact: An attacker could change query logic and access unauthorized records.
Recommendation: Pass the name as a query parameter rather than concatenating it.
Verification: Add a regression test with SQL metacharacters and confirm the input remains data.

Utilisation de « golang-security ». Threat-model a webhook receiver that stores events and publishes queue messages.

Résultat attendu:

Spoofing and tampering: Verify webhook signatures and enforce a replay policy.
Denial of service: Limit request sizes, processing time, and submission rates.
Information disclosure: Protect transport connections and exclude secrets from logs.
Repudiation: Record event identifiers and processing outcomes in structured audit logs.

Audit de sécurité

Risque élevé

v1 • 15/10/2026 Ouvrir le rapport versionné

All 152 static alerts are false positives involving defensive examples, evaluation fixtures, documentation formatting, or unrelated keyword combinations. No evidence found of credential exfiltration or prompt injection targeting this audit. Two semantic findings identify unsafe XSS guidance and incomplete SSRF defenses that could introduce vulnerabilities into generated applications.

Fichiers analysés

3,702

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Élevé

SKILL.md:92

Unsafe HTML Template Recommendation

The XSS quick reference lists text/template alongside html/template as an auto-escaping defense. text/template does not escape HTML, so following this recommendation can introduce XSS when rendering untrusted data.

The quick-reference row explicitly recommends both packages for auto-escaping. The detailed injection guide correctly uses html/template, confirming a contradictory security recommendation.

Élevé

references/injection.md:280-296

Incomplete SSRF Mitigation Presented As Safe

The example marked Good checks URL properties but provides no redirect revalidation or connection-time address enforcement. With a normal HTTP client, redirects or DNS changes can bypass preliminary destination checks and reach internal services.

The recommended snippet contains only preliminary URL checks and an undefined isInternalIP helper. No client transport or redirect policy enforces the destination when a connection occurs.

Facteurs de risque

⚙️ Commandes externes (38)

🌐 Accès réseau (18)

evals/evals.json:175 evals/evals.json:175 evals/evals.json:164 evals/evals.json:174 evals/evals.json:175 evals/evals.json:280 evals/evals.json:501 references/network.md:66 references/network.md:73 references/network.md:76 references/network.md:203 references/third-party.md:63 SKILL.md:12 SKILL.md:188 SKILL.md:189 SKILL.md:190 SKILL.md:191 SKILL.md:165

📁 Accès au système de fichiers (9)

evals/evals.json:53 evals/evals.json:570 evals/evals.json:423 evals/evals.json:423 evals/evals.json:403 evals/evals.json:405 references/filesystem.md:29 references/filesystem.md:180 references/injection.md:189

🔑 Variables d’environnement (10)

references/secrets.md:30 references/secrets.md:31 references/secrets.md:57 references/secrets.md:58 references/secrets.md:190 references/secrets.md:90 references/secrets.md:92 references/secrets.md:104 references/secrets.md:106 references/secrets.md:31

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/samber-golang-security/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-security/security.svg)](https://skillstore.io/skills/samber-golang-security?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/samber-golang-security?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-security/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/samber-golang-security.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

samber. (2026). golang-security security audit report (audit version 1) [Author version 1.2.2]. Skillstore. https://skillstore.io/skills/samber-golang-security/audits/1

Citation BibTeX

@techreport{samber-samber-golang-security-2026,
  author = {samber},
  title = {golang-security security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-security/audits/1},
  note = {Author version 1.2.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-security security audit report (audit version 1)"
version: "1.2.2"
type: report
authors:
  - name: "samber"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/samber-golang-security/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-security:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Review a Go Pull Request

Trace changed handlers and adjacent data flows to identify exploitable input, authorization, and configuration risks.

Audit a Service

Organize a codebase review by vulnerability domain and prioritize findings with evidence and remediation recommendations.

Model System Threats

Map trust boundaries across APIs, databases, queues, and external integrations before choosing security controls.

Essayez ces prompts

Check One Handler

Review [handler] for security risks. Explain untrusted inputs, existing protections, and recommended fixes. Do not modify files.

Review a Pull Request

Review [pull request or diff] for security issues. Trace relevant call sites and validation. Report evidence, exploitability, severity, and focused remediation.

Design Secure File Access

Design secure file serving for [service] using Go [version]. Address traversal, symlinks, permissions, resource limits, and regression tests. Explain remaining assumptions.

Audit Trust Boundaries

Audit [repository] across injection, cryptography, web security, authorization, and concurrency. Apply STRIDE and DREAD. Separate exploitable findings from hardening recommendations. Propose verification tests.

Bonnes pratiques

Provide relevant code, deployment context, Go version, and trust boundaries before requesting a review.
Validate recommendations against current library behavior and distinguish demonstrated exploits from optional hardening.
Verify each mitigation with focused regression tests and appropriate static, race, or fuzz testing.

Éviter

Treating instructional snippets or generated fixes as production-ready without independent review.
Sharing live credentials, private keys, or unnecessary personal data in review prompts.
Equating keyword matches or severity scores with proven exploitability.

Foire aux questions

Which assistants can use this skill?

The skill declares compatibility with Codex and Claude Code. It provides instructions and reference documents rather than a separate executable application.

Does this skill automatically scan my code?

It guides an assistant through reviews and documents scanner commands. Actual scanning depends on available tools, project access, and user authorization.

What Go versions do the examples target?

Filesystem examples prefer os.Root on Go 1.24 or newer. Older-version alternatives are included, with limitations for symlink resistance.

Are all recommendations safe to copy directly?

No. The XSS quick reference incorrectly includes text/template, and the SSRF example needs redirect and connection controls. Review examples before use.

Can it help prioritize vulnerabilities?

Yes. It describes STRIDE threat analysis and DREAD scoring, alongside data-flow tracing and evidence-based review workflows.

Does it replace dependency management or CI configuration?

No. It references govulncheck and verification commands, but delegates comprehensive dependency management and CI integration to related skills.