Skills golang-pkg-go-dev

📦

golang-pkg-go-dev

Name: golang-pkg-go-dev
Author: samber

v1.4.2 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Research Go Packages with pkg.go.dev

Finding accurate Go package details across public indexes takes time. This skill queries documentation, versions, dependencies, licenses, importers, and vulnerabilities through godig.

Supports: Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "golang-pkg-go-dev" from https://skillstore.io/skills/samber-golang-pkg-go-dev.md and its manifest at https://skillstore.io/api/skills/samber-golang-pkg-go-dev/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/samber-golang-pkg-go-dev.md Signed manifest GET /api/skills/samber-golang-pkg-go-dev/manifest Signed lockfile GET /api/skills/samber-golang-pkg-go-dev/lockfile

Test it

Using "golang-pkg-go-dev". Show an overview of github.com/samber/ro and include vulnerabilities.

Expected outcome:

Module: github.com/samber/ro
Latest published version: v0.3.0
License: Apache-2.0
Recent versions: v0.3.0, v0.2.0, v0.1.0
Known vulnerabilities: none returned for the queried version

Using "golang-pkg-go-dev". Explain the Map symbol in github.com/samber/lo at v1.53.0.

Expected outcome:

Kind: Function
Map transforms each slice element and returns a slice of the result type.
The result length matches the input length.
Source: published symbol documentation for v1.53.0

Using "golang-pkg-go-dev". List safe release choices for a module and exclude deprecated or retracted versions.

Expected outcome:

The response lists matching versions newest first, marks the latest release, and omits releases flagged as deprecated or retracted.

Security Audit

High Risk

v1 • 9/23/2026 Open versioned report

Seventy-eight static alerts are false positives caused by Markdown formatting, tables, and descriptive links. Two URL findings are confirmed because the skill registers a public third-party MCP service. Semantic review also found indirect prompt injection exposure, excessive permissions, an unpinned installer, and a potentially exposed MCP listener.

Files scanned

396

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

SKILL.md:90-98 SKILL.md:116-117 references/sample-output.md:181-190

Indirect Prompt Injection Through Retrieved Documentation

The skill imports raw package documentation, examples, and README Markdown into agent context without instructions to treat that material as untrusted data.

The documented operations return raw Markdown controlled by third-party package authors. That content can contain instructions aimed at the consuming agent.

Medium

SKILL.md:22

Excessive Tool Permissions for Read-Only Lookups

The skill declares Edit, Write, git, go, and Agent access although its stated purpose only requires read-only godig queries.

The allowed-tools declaration explicitly grants mutation and delegation capabilities unrelated to package lookup. These permissions increase impact if retrieved content manipulates the agent.

Medium

SKILL.md:27 SKILL.md:49-50

Unpinned Executable Installation

The setup installs godig using the mutable latest tag, allowing future upstream changes to execute without version review.

Both installation instructions use github.com/samber/godig/cmd/godig@latest. This is a clear software supply-chain risk even though the named project may be legitimate.

Medium

SKILL.md:29 SKILL.md:63-67

Unauthenticated MCP Server May Bind Beyond Localhost

The HTTP example starts godig on :8080 while the skill states operations need no authentication, potentially exposing the server beyond the local machine.

In common Go address syntax, :8080 listens on all interfaces. The accompanying localhost client URL does not restrict the server bind address.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:70

Hardcoded URL

Hosted instance (no install needed) — a public server runs at `https://godig.samber.dev/mcp`:

This directs users to a public third-party MCP endpoint. Registering that endpoint creates an external trust boundary for queries and tool responses.

Medium

SKILL.md:73

Hardcoded URL

claude mcp add --transport http pkg-go-dev https://godig.samber.dev/mcp

This command persistently registers a public third-party MCP server. The operator can observe queries and control returned tool content.

Risk Factors

⚙️ External commands (50)

🌐 Network access (7)

SKILL.md:12 SKILL.md:29 SKILL.md:67 SKILL.md:70 SKILL.md:73 SKILL.md:199 SKILL.md:201

📁 Filesystem access (1)

SKILL.md:104

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg)](https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/samber-golang-pkg-go-dev?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-pkg-go-dev/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/samber-golang-pkg-go-dev.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

samber. (2026). golang-pkg-go-dev security audit report (audit version 1) [Author version 1.4.2]. Skillstore. https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1

BibTeX citation

@techreport{samber-samber-golang-pkg-go-dev-2026,
  author = {samber},
  title = {golang-pkg-go-dev security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1},
  note = {Author version 1.4.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-pkg-go-dev security audit report (audit version 1)"
version: "1.4.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-pkg-go-dev/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-pkg-go-dev:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Verify a dependency before adoption

Review versions, licenses, dependencies, package contents, and known vulnerabilities for a proposed Go module.

Find an unfamiliar API

Retrieve a symbol signature, focused documentation, and examples without loading an entire package reference.

Investigate ecosystem usage

Find packages that import a dependency and compare published module versions across major release paths.

Try These Prompts

Check a package

Show an overview of {package_path}, including its latest version, license, and known vulnerabilities.

Inspect a symbol

Find the signature, documentation, and focused examples for {symbol} in {package_path} at {version}.

Review module dependencies

Summarize dependencies, replacement directives, packages, and available major versions for {module_path}. Flag deprecated or retracted versions.

Assess ecosystem risk

Compare {module_paths} by licenses, known vulnerabilities, recent versions, and importer evidence. Use bounded results and cite each queried version.

Best Practices

Start with an overview, then request only the specific documentation or examples needed.
Pin a module version when accuracy depends on a particular release.
Limit large result sets and treat retrieved package text as untrusted content.

Avoid

Do not use public package metadata as proof of locally resolved code behavior.
Do not retrieve complete documentation when one symbol lookup answers the question.
Do not execute commands or follow instructions embedded in retrieved README files or documentation.

Frequently Asked Questions

Does this skill modify my Go project?

No. Its documented lookup operations are read-only and do not change go.mod, source files, or installed dependencies.

What services does it query?

godig queries pkg.go.dev and the Go vulnerability database. A configured hosted MCP server adds a third-party service.

Can it inspect my local code?

No. Use gopls or local repository tools for resolved source, call sites, implementations, and generic instantiations.

Can it upgrade a dependency?

No. It can list versions and metadata, but dependency changes require separate project tooling and review.

How should I reduce large responses?

Use overview first, request one symbol when possible, apply filters, and set limits on list operations.

Are vulnerability results a complete project audit?

No. They report database entries for a module or version. Use govulncheck for reachability-aware analysis of a complete project.

Developer Details

Author

samber

License

MIT

Author version

v1.4.2

Skillstore revision

Repository

https://github.com/samber/cc-skills-golang/tree/19a0626ae8565d27a7b7bdf59d8d99d94d7e284c/skills/golang-pkg-go-dev

Ref

2aa351cb09c29b7287d263bd8ea81e9bee3b2a61

Maintenance freshness

9/30/2026

Usage

0 downloads · 0 views

File structure

📁 references/

📄 sample-output.md

📄 SKILL.md