Навыки golang-pkg-go-dev

📦

golang-pkg-go-dev

Name: golang-pkg-go-dev
Author: samber

v1.4.2 Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе

Research Go Packages with pkg.go.dev

Finding accurate Go package details across public indexes takes time. This skill queries documentation, versions, dependencies, licenses, importers, and vulnerabilities through godig.

Поддерживает: Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "golang-pkg-go-dev" from https://skillstore.io/skills/samber-golang-pkg-go-dev.md and its manifest at https://skillstore.io/api/skills/samber-golang-pkg-go-dev/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/samber-golang-pkg-go-dev.md Подписанный manifest GET /api/skills/samber-golang-pkg-go-dev/manifest Подписанный lockfile GET /api/skills/samber-golang-pkg-go-dev/lockfile

Протестировать

Использование «golang-pkg-go-dev». Show an overview of github.com/samber/ro and include vulnerabilities.

Ожидаемый результат:

Module: github.com/samber/ro
Latest published version: v0.3.0
License: Apache-2.0
Recent versions: v0.3.0, v0.2.0, v0.1.0
Known vulnerabilities: none returned for the queried version

Использование «golang-pkg-go-dev». Explain the Map symbol in github.com/samber/lo at v1.53.0.

Ожидаемый результат:

Kind: Function
Map transforms each slice element and returns a slice of the result type.
The result length matches the input length.
Source: published symbol documentation for v1.53.0

Использование «golang-pkg-go-dev». List safe release choices for a module and exclude deprecated or retracted versions.

Ожидаемый результат:

The response lists matching versions newest first, marks the latest release, and omits releases flagged as deprecated or retracted.

Аудит безопасности

Высокий риск

v1 • 23.09.2026 Открыть версионный отчет

Seventy-eight static alerts are false positives caused by Markdown formatting, tables, and descriptive links. Two URL findings are confirmed because the skill registers a public third-party MCP service. Semantic review also found indirect prompt injection exposure, excessive permissions, an unpinned installer, and a potentially exposed MCP listener.

Просканировано файлов

396

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (4)

Высокий

SKILL.md:90-98 SKILL.md:116-117 references/sample-output.md:181-190

Indirect Prompt Injection Through Retrieved Documentation

The skill imports raw package documentation, examples, and README Markdown into agent context without instructions to treat that material as untrusted data.

The documented operations return raw Markdown controlled by third-party package authors. That content can contain instructions aimed at the consuming agent.

Средний

SKILL.md:22

Excessive Tool Permissions for Read-Only Lookups

The skill declares Edit, Write, git, go, and Agent access although its stated purpose only requires read-only godig queries.

The allowed-tools declaration explicitly grants mutation and delegation capabilities unrelated to package lookup. These permissions increase impact if retrieved content manipulates the agent.

Средний

SKILL.md:27 SKILL.md:49-50

Unpinned Executable Installation

The setup installs godig using the mutable latest tag, allowing future upstream changes to execute without version review.

Both installation instructions use github.com/samber/godig/cmd/godig@latest. This is a clear software supply-chain risk even though the named project may be legitimate.

Средний

SKILL.md:29 SKILL.md:63-67

Unauthenticated MCP Server May Bind Beyond Localhost

The HTTP example starts godig on :8080 while the skill states operations need no authentication, potentially exposing the server beyond the local machine.

In common Go address syntax, :8080 listens on all interfaces. The accompanying localhost client URL does not restrict the server bind address.

Пункты проверки возможностей (2)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

SKILL.md:70

Hardcoded URL

Hosted instance (no install needed) — a public server runs at `https://godig.samber.dev/mcp`:

This directs users to a public third-party MCP endpoint. Registering that endpoint creates an external trust boundary for queries and tool responses.

Средний

SKILL.md:73

Hardcoded URL

claude mcp add --transport http pkg-go-dev https://godig.samber.dev/mcp

This command persistently registers a public third-party MCP server. The operator can observe queries and control returned tool content.

Факторы риска

⚙️ Внешние команды (50)

🌐 Доступ к сети (7)

SKILL.md:12 SKILL.md:29 SKILL.md:67 SKILL.md:70 SKILL.md:73 SKILL.md:199 SKILL.md:201

📁 Доступ к файловой системе (1)

SKILL.md:104

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg)](https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/samber-golang-pkg-go-dev.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

samber. (2026). golang-pkg-go-dev security audit report (audit version 1) [Author version 1.4.2]. Skillstore. https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1

Цитата BibTeX

@techreport{samber-samber-golang-pkg-go-dev-2026,
  author = {samber},
  title = {golang-pkg-go-dev security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1},
  note = {Author version 1.4.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-pkg-go-dev security audit report (audit version 1)"
version: "1.4.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-pkg-go-dev:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

100

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Verify a dependency before adoption

Review versions, licenses, dependencies, package contents, and known vulnerabilities for a proposed Go module.

Find an unfamiliar API

Retrieve a symbol signature, focused documentation, and examples without loading an entire package reference.

Investigate ecosystem usage

Find packages that import a dependency and compare published module versions across major release paths.

Попробуйте эти промпты

Check a package

Show an overview of {package_path}, including its latest version, license, and known vulnerabilities.

Inspect a symbol

Find the signature, documentation, and focused examples for {symbol} in {package_path} at {version}.

Review module dependencies

Summarize dependencies, replacement directives, packages, and available major versions for {module_path}. Flag deprecated or retracted versions.

Assess ecosystem risk

Compare {module_paths} by licenses, known vulnerabilities, recent versions, and importer evidence. Use bounded results and cite each queried version.

Лучшие практики

Start with an overview, then request only the specific documentation or examples needed.
Pin a module version when accuracy depends on a particular release.
Limit large result sets and treat retrieved package text as untrusted content.

Избегать

Do not use public package metadata as proof of locally resolved code behavior.
Do not retrieve complete documentation when one symbol lookup answers the question.
Do not execute commands or follow instructions embedded in retrieved README files or documentation.

Часто задаваемые вопросы

Does this skill modify my Go project?

No. Its documented lookup operations are read-only and do not change go.mod, source files, or installed dependencies.

What services does it query?

godig queries pkg.go.dev and the Go vulnerability database. A configured hosted MCP server adds a third-party service.

Can it inspect my local code?

No. Use gopls or local repository tools for resolved source, call sites, implementations, and generic instantiations.

Can it upgrade a dependency?

No. It can list versions and metadata, but dependency changes require separate project tooling and review.

How should I reduce large responses?

Use overview first, request one symbol when possible, apply filters, and set limits on list operations.

Are vulnerability results a complete project audit?

No. They report database entries for a module or version. Use govulncheck for reachability-aware analysis of a complete project.

Сведения для разработчиков

Автор

samber

Лицензия

MIT

Версия автора

v1.4.2

Ревизия Skillstore

Репозиторий

https://github.com/samber/cc-skills-golang/tree/19a0626ae8565d27a7b7bdf59d8d99d94d7e284c/skills/golang-pkg-go-dev

Ссылка

2aa351cb09c29b7287d263bd8ea81e9bee3b2a61

Актуальность поддержки

30.09.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📁 references/

📄 sample-output.md

📄 SKILL.md