Skills golang-benchmark

📦

golang-benchmark

Name: golang-benchmark
Author: samber

v1.3.2 Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Measure and Diagnose Go Performance

Go performance work often fails because benchmarks are noisy or profiles are misread. This skill provides a rigorous workflow for measurement, comparison, and diagnosis.

Supports: Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "golang-benchmark" from https://skillstore.io/skills/samber-golang-benchmark.md and its manifest at https://skillstore.io/api/skills/samber-golang-benchmark/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/samber-golang-benchmark.md Signed manifest GET /api/skills/samber-golang-benchmark/manifest Signed lockfile GET /api/skills/samber-golang-benchmark/lockfile

Test it

Using "golang-benchmark". A candidate benchmark is three percent faster, but benchstat reports no significant difference.

Expected outcome:

Do not claim an improvement. Increase sample quality, control environmental noise, and compare both versions under identical conditions.

Using "golang-benchmark". A CPU profile is dominated by runtime allocation functions.

Expected outcome:

Rank cumulative callers to find application entry points.
Inspect hot source lines and collect an allocation profile.
Confirm escape behavior before changing allocation strategy.

Using "golang-benchmark". CI benchmarks vary by ten percent between runs.

Expected outcome:

Use a dedicated runner, run benchmarks serially, increase repetitions, and set thresholds above measured environmental variance.

Security Audit

Medium Risk

v1 • 9/23/2026 Open versioned report

Most alerts are lexical false positives caused by Markdown, localhost examples, and profiling terminology. Confirmed risks include privileged CPU controls, token delegation, and an unauthenticated all-interface trace viewer. Semantic review also found insecure TLS guidance and an unpinned tool installation.

Files scanned

5,264

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

references/pprof.md:704-705

TLS Verification Bypass

The reference recommends an https+insecure profiling URL, which disables server certificate verification and permits interception or impersonation.

The adjacent comment explicitly says server certificate verification is skipped, and the command uses the insecure scheme.

Medium

SKILL.md:19 SKILL.md:32

Unpinned Tool Installation

The skill installs benchstat from a mutable latest version, reducing reproducibility and increasing exposure to an unexpected upstream release.

Both installation declarations explicitly use the mutable @latest selector rather than a fixed tool version.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/ci-regression.md:259

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

This command uses sudo to change the CPU governor for every core. It can alter host-wide performance and stability.

High

references/ci-regression.md:268

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

This command uses sudo to disable Intel Turbo Boost through a kernel control. It changes host-wide CPU behavior.

High

references/ci-regression.md:271

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

This command uses sudo to disable AMD boost through a kernel control. It changes host-wide CPU behavior.

High

references/ci-regression.md:289

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control

This command uses sudo to disable SMT system-wide. It can reduce capacity and disrupt other workloads.

High

references/ci-regression.md:292

sudo privilege escalation

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

This command uses sudo to take a CPU core offline. An incorrect core selection can disrupt the host.

High

references/ci-regression.md:303

sudo privilege escalation

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The setup script uses sudo to change every CPU governor. Running it modifies the entire host, not only the benchmark process.

High

references/ci-regression.md:304

sudo privilege escalation

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The setup script uses sudo to disable Turbo Boost. Error suppression can hide an unsupported or failed system modification.

High

references/ci-regression.md:305

sudo privilege escalation

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The setup script uses sudo to disable SMT. Error suppression can hide a failed host-wide configuration change.

High

references/ci-regression.md:259

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The command writes to a /sys CPU governor control for all cores. This is a privileged host-wide configuration change.

High

references/ci-regression.md:268

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo

The command writes to the Intel pstate no_turbo control in /sys. This changes host-wide CPU behavior.

High

references/ci-regression.md:271

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpufreq/boost

The command writes to the AMD boost control in /sys. This changes host-wide CPU behavior.

High

references/ci-regression.md:289

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control

The command writes to the SMT control in /sys. This disables simultaneous multithreading across the host.

High

references/ci-regression.md:292

Linux /sys filesystem access

echo 0 | sudo tee /sys/devices/system/cpu/cpu1/online # if cpu0 and cpu1 are siblings

The command writes to a CPU online control in /sys. It can remove a processor from service.

High

references/ci-regression.md:303

Linux /sys filesystem access

echo performance | sudo tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor

The script writes a performance governor to every matching /sys CPU control. This is a privileged host-wide change.

High

references/ci-regression.md:304

Linux /sys filesystem access

echo 1 | sudo tee /sys/devices/system/cpu/intel_pstate/no_turbo 2>/dev/null || true

The script writes to the Intel pstate no_turbo control in /sys. It suppresses errors from the system modification.

High

references/ci-regression.md:305

Linux /sys filesystem access

echo off | sudo tee /sys/devices/system/cpu/smt/control 2>/dev/null || true

The script writes to the SMT control in /sys. It suppresses errors from the host-wide system modification.

High

references/ci-regression.md:162

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow passes GITHUB_TOKEN to a third-party action that publishes content. A compromised action could misuse repository permissions.

High

references/trace.md:115

Hardcoded IP address

go tool trace -http=0.0.0.0:8080 trace.out

Binding the trace viewer to 0.0.0.0 exposes diagnostic data on every network interface. The example provides no authentication control.

Risk Factors

⚙️ External commands (50)

evals/evals.json:6 evals/evals.json:7 evals/evals.json:24 evals/evals.json:32 evals/evals.json:58-86 evals/evals.json:86 evals/evals.json:115-157 evals/evals.json:157-202 evals/evals.json:202-207 evals/evals.json:207-219 evals/evals.json:219 evals/evals.json:236-240 evals/evals.json:240-265 evals/evals.json:265-292 evals/evals.json:292-312 evals/evals.json:312 evals/evals.json:445-450 evals/evals.json:450-704 evals/evals.json:704-729 evals/evals.json:729-775 evals/evals.json:775-804 evals/evals.json:804 evals/evals.json:805 evals/evals.json:809-821 evals/evals.json:821-1000 evals/evals.json:1000 evals/evals.json:1019-1080 evals/evals.json:1080 evals/evals.json:1093 evals/evals.json:1385 evals/evals.json:1484 evals/evals.json:1489-1497 evals/evals.json:1497 evals/evals.json:1542-1655 evals/evals.json:1655 evals/evals.json:1742 evals/evals.json:1767 evals/evals.json:1846 references/benchstat.md:377 references/ci-regression.md:120 references/ci-regression.md:298 references/ci-regression.md:259 references/ci-regression.md:268 references/ci-regression.md:271 references/ci-regression.md:289 references/ci-regression.md:292 references/ci-regression.md:303 references/ci-regression.md:304 references/ci-regression.md:305 SKILL.md:3

🌐 Network access (27)

📁 Filesystem access (18)

🔑 Env variables (1)

references/ci-regression.md:162

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/samber-golang-benchmark/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg)](https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/samber-golang-benchmark?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-benchmark/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/samber-golang-benchmark.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

samber. (2026). golang-benchmark security audit report (audit version 1) [Author version 1.3.2]. Skillstore. https://skillstore.io/skills/samber-golang-benchmark/audits/1

BibTeX citation

@techreport{samber-samber-golang-benchmark-2026,
  author = {samber},
  title = {golang-benchmark security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-benchmark/audits/1},
  note = {Author version 1.3.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-benchmark security audit report (audit version 1)"
version: "1.3.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-benchmark/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-benchmark:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Validate an Optimization

Create repeatable before-and-after benchmarks and decide whether measured changes are statistically significant.

Diagnose Production Latency

Correlate runtime metrics with CPU, memory, goroutine, and trace evidence to identify expensive paths.

Prevent CI Regressions

Establish benchmark baselines, practical thresholds, and controlled runner settings for pull request checks.

Try These Prompts

Write a Benchmark

Write a Go benchmark for [function]. Exclude setup time, report allocations, and use representative inputs.

Compare Two Results

Compare these baseline and candidate benchmark results. Explain significance, noise, allocation changes, and whether the optimization is supported.

Investigate a Profile

Analyze this [CPU or memory] profile summary. Identify likely application callers and recommend focused pprof commands for confirmation.

Design a Regression Gate

Design a CI benchmark gate for [repository]. Include baseline handling, sample counts, thresholds, runner controls, permissions, and failure investigation.

Best Practices

Compare versions on the same toolchain, hardware, workload, and runner configuration.
Collect multiple samples and use statistical results before making performance claims.
Preserve benchmark context, profile type, build identity, and hardware details with every result.

Avoid

Do not approve an optimization from one benchmark run or a nonsignificant result.
Do not run competing benchmarks concurrently on shared processors.
Do not expose profiling or trace endpoints without authentication and network restrictions.