Skills golang-spf13-viper

📦

golang-spf13-viper

Name: golang-spf13-viper
Author: samber

v1.1.2 Content revision r1 Safe ⚙️ External commands🔑 Env variables🌐 Network access📁 Filesystem access

Configure Go Applications with Viper

Layered Go configuration can fail through incorrect precedence, binding, or decoding. This skill provides focused Viper patterns for reliable setup, testing, and reloads.

Supports: Codex Code(CC)

🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "golang-spf13-viper" from https://skillstore.io/skills/samber-golang-spf13-viper.md and its manifest at https://skillstore.io/api/skills/samber-golang-spf13-viper/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/samber-golang-spf13-viper.md Signed manifest GET /api/skills/samber-golang-spf13-viper/manifest Signed lockfile GET /api/skills/samber-golang-spf13-viper/lockfile

Test it

Using "golang-spf13-viper". Why does an environment variable for database.host remain ignored?

Expected outcome:

The diagnosis identifies the missing dot-to-underscore key replacer and lists the required prefix, replacer, and automatic binding sequence.

Using "golang-spf13-viper". How should an optional configuration file be loaded?

Expected outcome:

The response distinguishes a missing file from parsing or permission errors, allowing only the missing-file case to continue.

Using "golang-spf13-viper". How can a service reload configuration without data races?

Expected outcome:

The response proposes candidate decoding, validation, synchronized replacement, error logging, and retention of the previous valid configuration.

Security Audit

Safe

v1 • 9/23/2026 Open versioned report

All 97 static alerts are contextual false positives. The matches are documentation syntax, Go tags, evaluation prose, conventional configuration examples, loopback addresses, or transparent upstream links.

Files scanned

1,310

Lines analyzed

Review items

False positives ignored

Risk Factors

⚙️ External commands (50)

🔑 Env variables (5)

evals/evals.json:344 evals/evals.json:349 references/binding-and-env.md:32 references/binding-and-env.md:36 references/sources-and-formats.md:24

🌐 Network access (6)

references/sources-and-formats.md:90 references/sources-and-formats.md:90 SKILL.md:12 SKILL.md:31 SKILL.md:32 SKILL.md:190

📁 Filesystem access (4)

references/sources-and-formats.md:67 references/sources-and-formats.md:38 references/sources-and-formats.md:67 SKILL.md:73

No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/samber-golang-spf13-viper/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-spf13-viper/security.svg)](https://skillstore.io/skills/samber-golang-spf13-viper?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/samber-golang-spf13-viper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-spf13-viper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/samber-golang-spf13-viper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

samber. (2026). golang-spf13-viper security audit report (audit version 1) [Author version 1.1.2]. Skillstore. https://skillstore.io/skills/samber-golang-spf13-viper/audits/1

BibTeX citation

@techreport{samber-samber-golang-spf13-viper-2026,
  author = {samber},
  title = {golang-spf13-viper security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-spf13-viper/audits/1},
  note = {Author version 1.1.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-spf13-viper security audit report (audit version 1)"
version: "1.1.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-spf13-viper/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-spf13-viper:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Configure a Go Service

Create layered file and environment configuration with predictable precedence and optional config files.

Connect Cobra Flags

Bind CLI flags before execution so explicit values override environment variables and files correctly.

Harden Runtime Reloads

Validate candidate settings and synchronize updates before replacing active service configuration.

Try These Prompts

Create Basic Configuration

Set up Viper for my Go service using a YAML file, MYAPP-prefixed environment variables, and sensible defaults.

Diagnose Environment Binding

Explain why MYAPP_DATABASE_HOST does not override database.host, then provide the correct Viper prefix, replacer, and AutomaticEnv setup.

Refactor Configuration Tests

Refactor my Viper tests to avoid shared global state. Use isolated instances and temporary environment values.

Design Safe Hot Reload

Design a production Viper reload flow that debounces events, decodes a candidate, validates it, and atomically updates synchronized application state.

Best Practices

Configure the environment prefix and key replacer before enabling automatic environment lookup.
Use explicit mapstructure tags and validate decoded configuration before application startup or reload.
Create a separate Viper instance for each test and protect shared runtime configuration with synchronization.

Avoid

Do not rely on the global Viper instance across tests because state persists between cases.
Do not ignore every ReadInConfig error because malformed or unreadable files require attention.
Do not update shared configuration directly from a watch callback without validation and synchronization.