Skills go-mod-helper
📦
go-mod-helper
Content revision r1 Critical ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Manage Go Modules and Dependencies
Go module setup and dependency updates can be error-prone across private repositories, workspaces, and releases. This skill provides command guidance for Go modules, dependency cleanup, versioning, and troubleshooting.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "go-mod-helper" from https://skillstore.io/skills/curiouslearner-go-mod-helper.md and its manifest at https://skillstore.io/api/skills/curiouslearner-go-mod-helper/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "go-mod-helper". I need to start a new Go API project with modules.
Expected outcome:
- Recommended module path and project layout.
- A short setup sequence for module initialization, dependency addition, tidy, verify, and tests.
- Notes about committing go.mod and go.sum.
Using "go-mod-helper". My private GitHub module cannot be downloaded in CI.
Expected outcome:
- A checklist covering private module patterns, Git authentication, proxy settings, and checksum configuration.
- Warnings for token handling and global Git settings.
- Suggested verification commands to run after configuration changes.
Using "go-mod-helper". I am publishing a v2 Go module.
Expected outcome:
- A release checklist for module path updates, semantic import versioning, tests, tags, and documentation.
- Common mistakes to avoid with v2 import paths and tags.
Security Audit
Criticalv8 • 7/5/2026 Open versioned report
Most static detections are Markdown false positives from code fences, Go import and require syntax, module examples, and normal Go commands. I confirmed risks where the skill instructs handling plaintext tokens, netrc files, SSH private keys, and global credential or module configuration. No prompt-injection language was found in SKILL.md.
1
Files scanned
945
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (7)
Critical
SSH directory access
ssh-add ~/.ssh/id_ed25519
The example uses ~/.ssh/id_ed25519, a default SSH private-key path. Even without exfiltration intent, automated access to this key material is a critical sensitive-file risk.
Critical
SSH private key file
ssh-add ~/.ssh/id_ed25519
The example uses ~/.ssh/id_ed25519, a default SSH private-key path. Even without exfiltration intent, automated access to this key material is a critical sensitive-file risk.
Critical
netrc credentials file
# Create ~/.netrc for HTTPS auth
The example creates or modifies ~/.netrc, which stores authentication secrets for Git over HTTPS. Writing tokens there is sensitive credential handling and should not be automatic.
Critical
netrc credentials file
cat > ~/.netrc << EOF
The example creates or modifies ~/.netrc, which stores authentication secrets for Git over HTTPS. Writing tokens there is sensitive credential handling and should not be automatic.
Critical
netrc credentials file
chmod 600 ~/.netrc
The example creates or modifies ~/.netrc, which stores authentication secrets for Git over HTTPS. Writing tokens there is sensitive credential handling and should not be automatic.
High
Plaintext Git Credential Storage Guidance
SKILL.md recommends git credential.helper store for private repository access. This can persist Git credentials in plaintext and affects future Git commands.
The guidance directly sets a global Git credential helper and follows it with global URL rewriting. This is a clear persistent credential-handling risk, although it is presented for a legitimate troubleshooting scenario.
Medium
Broad Persistent Module Trust Configuration
The private-module guidance sets persistent GOPRIVATE, GONOPROXY, and GONOSUMDB patterns. Overbroad patterns can bypass proxy or checksum controls for more modules than intended.
The commands use go env -w and broad wildcard patterns, so the changes persist beyond one project. This is normal Go private-module guidance but should be scoped and consent-gated.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
# Create ~/.netrc for HTTPS auth
The private-module instructions direct creation or permission changes for ~/.netrc, a hidden credential file. This is legitimate guidance but a real risk if an agent writes token material without explicit consent.
High
Hidden file in home directory
cat > ~/.netrc << EOF
The private-module instructions direct creation or permission changes for ~/.netrc, a hidden credential file. This is legitimate guidance but a real risk if an agent writes token material without explicit consent.
High
Hidden file in home directory
chmod 600 ~/.netrc
The private-module instructions direct creation or permission changes for ~/.netrc, a hidden credential file. This is legitimate guidance but a real risk if an agent writes token material without explicit consent.
High
Hidden file in home directory
ssh-add ~/.ssh/id_ed25519
The SSH guidance accesses ~/.ssh/id_ed25519 through ssh-add. This is a sensitive private-key path and should require explicit user approval before execution.
High
Hidden file access
# Create ~/.netrc for HTTPS auth
The private-module instructions direct creation or permission changes for ~/.netrc, a hidden credential file. This is legitimate guidance but a real risk if an agent writes token material without explicit consent.
High
Hidden file access
cat > ~/.netrc << EOF
The private-module instructions direct creation or permission changes for ~/.netrc, a hidden credential file. This is legitimate guidance but a real risk if an agent writes token material without explicit consent.
High
Hidden file access
chmod 600 ~/.netrc
The private-module instructions direct creation or permission changes for ~/.netrc, a hidden credential file. This is legitimate guidance but a real risk if an agent writes token material without explicit consent.
High
Hidden file access
ssh-add ~/.ssh/id_ed25519
The SSH guidance accesses ~/.ssh/id_ed25519 through ssh-add. This is a sensitive private-key path and should require explicit user approval before execution.
High
Git platform tokens
password YOUR_GITHUB_TOKEN
The sample .netrc content includes a GitHub token placeholder as password material. It teaches plaintext token handling in a credential file and should be guarded by explicit consent.
Medium
Hardcoded URL
- git config --global url."https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/".insteadOf "https://g
The GitLab CI example embeds CI_JOB_TOKEN in a global Git URL rewrite. This can persist or expose a CI credential if copied outside the intended job context.
Risk Factors
⚡ Contains scripts (7)
⚙️ External commands (108)
SKILL.md:47-72 SKILL.md:72-75 SKILL.md:75-111 SKILL.md:111-114 SKILL.md:114-117 SKILL.md:117-121 SKILL.md:121-128 SKILL.md:128-133 SKILL.md:133-179 SKILL.md:179-182 SKILL.md:182-194 SKILL.md:194-199 SKILL.md:199-233 SKILL.md:233-236 SKILL.md:236-255 SKILL.md:255-257 SKILL.md:257-268 SKILL.md:268-271 SKILL.md:271-286 SKILL.md:286-291 SKILL.md:291-300 SKILL.md:300-302 SKILL.md:302-308 SKILL.md:308-311 SKILL.md:311-329 SKILL.md:329-334 SKILL.md:334-352 SKILL.md:352-357 SKILL.md:357-366 SKILL.md:366-369 SKILL.md:369-379 SKILL.md:379-382 SKILL.md:382-387 SKILL.md:387-392 SKILL.md:392-399 SKILL.md:399-402 SKILL.md:402-408 SKILL.md:408-411 SKILL.md:411-418 SKILL.md:418-423 SKILL.md:423-434 SKILL.md:434-436 SKILL.md:436-447 SKILL.md:447-449 SKILL.md:449-457 SKILL.md:457-462 SKILL.md:462-477 SKILL.md:477-480 SKILL.md:480-489 SKILL.md:489-494 SKILL.md:494-511 SKILL.md:511-514 SKILL.md:514-530 SKILL.md:530-533 SKILL.md:533-546 SKILL.md:546-549 SKILL.md:549-562 SKILL.md:562-565 SKILL.md:565-580 SKILL.md:580-583 SKILL.md:583-595 SKILL.md:595-600 SKILL.md:600-611 SKILL.md:611-613 SKILL.md:613-620 SKILL.md:620-623 SKILL.md:623-633 SKILL.md:633-636 SKILL.md:636-646 SKILL.md:646-648 SKILL.md:648-655 SKILL.md:655-660 SKILL.md:660-676 SKILL.md:676-681 SKILL.md:681-717 SKILL.md:717-720 SKILL.md:720-745 SKILL.md:745-750 SKILL.md:750-769 SKILL.md:769-772 SKILL.md:772-806 SKILL.md:806-811 SKILL.md:811-826 SKILL.md:826-829 SKILL.md:829-845 SKILL.md:845-864 SKILL.md:864-865 SKILL.md:865-870 SKILL.md:870-874 SKILL.md:874-891 SKILL.md:891-901 SKILL.md:901-905 SKILL.md:905-931 SKILL.md:931-944 SKILL.md:374 SKILL.md:755 SKILL.md:756 SKILL.md:775 SKILL.md:776 SKILL.md:777 SKILL.md:780 SKILL.md:800 SKILL.md:803 SKILL.md:804 SKILL.md:805 SKILL.md:369-379 SKILL.md:750-769 SKILL.md:772-806
🌐 Network access (7)
📁 Filesystem access (10)
🔑 Env variables (1)
Detected Patterns
SSH directory accessSSH private key filenetrc credentials file×3
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/curiouslearner-go-mod-helper/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/curiouslearner-go-mod-helper?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/curiouslearner-go-mod-helper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-go-mod-helper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/curiouslearner-go-mod-helper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CuriousLearner. (2026). go-mod-helper security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-go-mod-helper/audits/8BibTeX citation
@techreport{curiouslearner-curiouslearner-go-mod-helper-2026,
author = {CuriousLearner},
title = {go-mod-helper security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/curiouslearner-go-mod-helper/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "go-mod-helper security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CuriousLearner"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/curiouslearner-go-mod-helper/audits/8"
identifiers:
- type: other
value: "skillstore:curiouslearner-go-mod-helper:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
72
Community
74
Spec Compliance
What You Can Build
Start a Go Service
Initialize a module, choose a project layout, add dependencies, and prepare basic build and test commands.
Fix Dependency Resolution
Diagnose checksum mismatches, missing modules, version conflicts, and corrupted module cache problems.
Prepare Private Module Access
Configure private module paths, Git access methods, and CI dependency download steps with review checkpoints.
Try These Prompts
Initialize a Module
Use go-mod-helper to initialize a Go module for this repository. Explain the module path, expected files, and first tidy and test steps.
Clean Dependencies
Use go-mod-helper to review my go.mod and go.sum files. Recommend safe dependency cleanup, update, download, and verification steps.
Debug Private Modules
Use go-mod-helper to troubleshoot private module resolution. Identify GOPRIVATE, Git authentication, proxy, and checksum settings that need review.
Plan a Release
Use go-mod-helper to prepare a Go module release plan. Include semantic versioning, v2 path rules, CI checks, tags, and documentation tasks.
Best Practices
- Run go mod tidy and go mod verify before committing dependency changes.
- Scope private-module settings to the smallest required organization or repository pattern.
- Review credential and global configuration commands before executing them.
Avoid
- Do not paste real access tokens into shared prompts, logs, or reusable examples.
- Do not disable checksum verification broadly for public module paths.
- Do not update all dependencies without tests and a clear rollback plan.
Frequently Asked Questions
What does this skill help with?
It helps with Go module setup, dependency commands, private modules, workspaces, vendoring, CI examples, and common troubleshooting workflows.
Can it edit go.mod for me?
It provides command guidance and review steps. Any file changes should be checked against your project requirements.
Does it support private repositories?
Yes. It explains GOPRIVATE, Git URL rewriting, SSH, token-based access, and CI configuration patterns.
Is credential setup automatic?
No. Credential commands are sensitive and should require explicit user approval before execution.
Can it fix checksum mismatches?
It gives troubleshooting steps for cache cleanup, dependency download, tidy, verification, and GOSUMDB review.
Does it replace security scanning?
No. Use dedicated dependency vulnerability scanners and organization policy checks for security decisions.
Developer Details
Author
CuriousLearnerLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
02f077c174c5335e2f5d02ca15e77b70d9543e58
Maintenance freshness
7/18/2026
Usage
5 downloads · 306 views
File structure
📄 SKILL.md