技能 golang-project-layout
📦
golang-project-layout
v1.4.2 內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取⚡ 包含腳本🌐 網路存取
Organize Go Projects and Multi-Module Workspaces
Unclear package boundaries make Go projects harder to maintain. This skill guides directory layout, module naming, test placement, and workspace setup around project requirements.
支援: Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "golang-project-layout" from https://skillstore.io/skills/samber-golang-project-layout.md and its manifest at https://skillstore.io/api/skills/samber-golang-project-layout/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「golang-project-layout」。 Plan a small CLI with a flat architecture and no dependency injection framework.
預期結果:
- Use one command entry point with minimal startup logic.
- Keep private behavior in a small internal package.
- Place tests beside their implementation and fixtures in a local testdata directory.
- Start with one module and omit a workspace.
正在使用「golang-project-layout」。 Our server and shared logging library are separate modules developed together. Should we use a workspace?
預期結果:
- A workspace fits related modules that need local cross-module development.
- Add both existing module directories to workspace membership.
- Keep each module's dependency metadata separate.
- Use local workspace resolution instead of repeated replacement directives.
正在使用「golang-project-layout」。 Where should private request parsing and a reusable public logging package live?
預期結果:
- Keep request parsing in an internal package.
- Expose the logging API through a public package when external consumers need it.
- For a dedicated library module, prefer a root-level public package.
- Keep executable startup logic separate from reusable behavior.
安全審計
高風險v1 • 2026/10/15 開啟版本化報告
All 78 static matches are false positives involving documentation, Go syntax, ignore rules, or ordinary build automation. A separate high-severity prompt injection directs persistent agent configuration changes to always load another skill without user confirmation. No evidence found of credential exfiltration or malicious network execution in the reviewed files.
8
已掃描檔案
998
分析行數
0
複核項目
0
已忽略的誤報
已確認的安全問題 (1)
高
Prompt Injection Attempt Detected
SKILL.md:119 says "Write the always-load directive" into the project's agent-config file and specifies "no user confirmation needed". This persists instructions to load another skill across sessions without consent, extending authority beyond the requested Go layout task.
The checklist explicitly requires persistent instruction changes and bypasses confirmation. The related-skills entry reinforces this behavior; the referenced skill's contents were not provided.
風險因素
⚙️ 外部命令 (50)
assets/.gitignore:10 assets/Makefile:7 assets/Makefile:8 assets/Makefile:18 assets/Makefile:19 assets/Makefile:24 assets/Makefile:35 assets/Makefile:36 assets/Makefile:40 assets/Makefile:45 assets/Makefile:59 assets/Makefile:60 assets/Makefile:79 assets/Makefile:80 assets/Makefile:84 assets/Makefile:85 assets/Makefile:89 assets/Makefile:90 assets/Makefile:110 evals/evals.json:34 evals/evals.json:49 references/config.md:33-34 references/config.md:34-35 references/config.md:35-37 references/config.md:37-38 references/config.md:38-39 references/config.md:39-49 references/directory-layouts.md:30-51 SKILL.md:3 SKILL.md:30 SKILL.md:34 SKILL.md:38 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:54 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:63-72 SKILL.md:72-76 SKILL.md:76-80 SKILL.md:80 SKILL.md:90-96 SKILL.md:96 SKILL.md:100-107 SKILL.md:107-111 SKILL.md:111-112
📁 檔案系統存取 (2)
⚡ 包含腳本 (2)
🌐 網路存取 (2)
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/samber-golang-project-layout/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/samber-golang-project-layout?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/samber-golang-project-layout?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-project-layout/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/samber-golang-project-layout.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
samber. (2026). golang-project-layout security audit report (audit version 1) [Author version 1.4.2]. Skillstore. https://skillstore.io/skills/samber-golang-project-layout/audits/1BibTeX 引用
@techreport{samber-samber-golang-project-layout-2026,
author = {samber},
title = {golang-project-layout security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/samber-golang-project-layout/audits/1},
note = {Author version 1.4.2}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-project-layout security audit report (audit version 1)"
version: "1.4.2"
type: report
authors:
- name: "samber"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/samber-golang-project-layout/audits/1"
identifiers:
- type: other
value: "skillstore:samber-golang-project-layout:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 59
架構
100
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Start a focused CLI project
Choose a small directory structure, a meaningful module path, and local test placement without unnecessary architecture layers.
Separate service entry points
Organize server, worker, and migration binaries while keeping shared business logic in private packages.
Coordinate related Go modules
Plan workspace membership and local dependency resolution for modules developed together in a monorepo.
試試這些提示
Choose a minimal layout
Help me plan a small Go CLI called [name]. Ask about architecture first, then dependency injection. Recommend a minimal layout without editing files.
Organize a service
Plan a layout for [service] with an API server and migration binary. Ask about architecture and dependency injection before suggesting packages. Include test placement.
Review package boundaries
Review [directory tree] for private implementation and reusable API boundaries. Recommend focused layout changes and explain module naming. Do not modify persistent agent configuration.
Plan a multi-module workspace
Design a go.work workspace for [module paths]. Explain local resolution, initialization, and cross-module testing. Identify when a single module is preferable. Propose changes before execution.
最佳實務
- Confirm project scope, architecture, and dependency injection preferences before creating directories.
- Use workspaces for related modules, not merely for multiple packages within one module.
- Review templates and commands before execution, and require approval for persistent agent configuration changes.
避免
- Creating empty architecture layers or public packages without a concrete need.
- Collecting business logic in entry points or vague utility packages.
- Automatically adding always-load skill instructions to persistent project configuration without explicit approval.
常見問題
What does this skill help organize?
It covers project directories, module naming, package boundaries, test placement, configuration, and multi-module workspaces.
Does every project need go.work?
No. A single module with multiple packages does not need a workspace. Workspaces support local development across related modules.
Is pkg required for public libraries?
No. The library reference recommends root-level public packages. The application guidance treats pkg as optional when external consumers need reusable code.
Does the skill include a complete application generator?
No. It provides instructions, examples, and build templates. An agent may apply them, but generated projects still require review and testing.
What tools are needed to run the suggested commands?
Go is required. The Makefile also uses Make and Git, while optional targets require tools such as golangci-lint, govulncheck, and air.
Does the skill change persistent agent instructions?
Its checklist requests an always-load directive without confirmation. Remove that instruction or explicitly approve a reviewed change before allowing persistent configuration edits.