技能 golang-spf13-viper

📦

golang-spf13-viper

Name: golang-spf13-viper
Author: samber

v1.1.2 內容修訂 r1 安全 ⚙️ 外部命令🔑 環境變數🌐 網路存取📁 檔案系統存取

Configure Go Applications with Viper

Layered Go configuration can fail through incorrect precedence, binding, or decoding. This skill provides focused Viper patterns for reliable setup, testing, and reloads.

支援: Codex Code(CC)

🥉 78 銅級

Maintain this Skill? Claim it 🥉 78 銅級

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "golang-spf13-viper" from https://skillstore.io/skills/samber-golang-spf13-viper.md and its manifest at https://skillstore.io/api/skills/samber-golang-spf13-viper/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/samber-golang-spf13-viper.md 已簽名 manifest GET /api/skills/samber-golang-spf13-viper/manifest 已簽名 lockfile GET /api/skills/samber-golang-spf13-viper/lockfile

測試它

正在使用「golang-spf13-viper」。 Why does an environment variable for database.host remain ignored?

預期結果:

The diagnosis identifies the missing dot-to-underscore key replacer and lists the required prefix, replacer, and automatic binding sequence.

正在使用「golang-spf13-viper」。 How should an optional configuration file be loaded?

預期結果:

The response distinguishes a missing file from parsing or permission errors, allowing only the missing-file case to continue.

正在使用「golang-spf13-viper」。 How can a service reload configuration without data races?

預期結果:

The response proposes candidate decoding, validation, synchronized replacement, error logging, and retention of the previous valid configuration.

安全審計

安全

v1 • 2026/9/23 開啟版本化報告

All 97 static alerts are contextual false positives. The matches are documentation syntax, Go tags, evaluation prose, conventional configuration examples, loopback addresses, or transparent upstream links.

已掃描檔案

1,310

分析行數

複核項目

已忽略的誤報

風險因素

⚙️ 外部命令 (50)

🔑 環境變數 (5)

evals/evals.json:344 evals/evals.json:349 references/binding-and-env.md:32 references/binding-and-env.md:36 references/sources-and-formats.md:24

🌐 網路存取 (6)

references/sources-and-formats.md:90 references/sources-and-formats.md:90 SKILL.md:12 SKILL.md:31 SKILL.md:32 SKILL.md:190

📁 檔案系統存取 (4)

references/sources-and-formats.md:67 references/sources-and-formats.md:38 references/sources-and-formats.md:67 SKILL.md:73

最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/samber-golang-spf13-viper/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/samber-golang-spf13-viper/security.svg)](https://skillstore.io/skills/samber-golang-spf13-viper?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/samber-golang-spf13-viper?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/samber-golang-spf13-viper/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/samber-golang-spf13-viper.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

samber. (2026). golang-spf13-viper security audit report (audit version 1) [Author version 1.1.2]. Skillstore. https://skillstore.io/skills/samber-golang-spf13-viper/audits/1

BibTeX 引用

@techreport{samber-samber-golang-spf13-viper-2026,
  author = {samber},
  title = {golang-spf13-viper security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/samber-golang-spf13-viper/audits/1},
  note = {Author version 1.1.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "golang-spf13-viper security audit report (audit version 1)"
version: "1.1.2"
type: report
authors:
  - name: "samber"
date-released: "2026-09-23"
url: "https://skillstore.io/skills/samber-golang-spf13-viper/audits/1"
identifiers:
  - type: other
    value: "skillstore:samber-golang-spf13-viper:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

規範符合度

你可以打造什麼

Configure a Go Service

Create layered file and environment configuration with predictable precedence and optional config files.

Connect Cobra Flags

Bind CLI flags before execution so explicit values override environment variables and files correctly.

Harden Runtime Reloads

Validate candidate settings and synchronize updates before replacing active service configuration.

試試這些提示

Create Basic Configuration

Set up Viper for my Go service using a YAML file, MYAPP-prefixed environment variables, and sensible defaults.

Diagnose Environment Binding

Explain why MYAPP_DATABASE_HOST does not override database.host, then provide the correct Viper prefix, replacer, and AutomaticEnv setup.

Refactor Configuration Tests

Refactor my Viper tests to avoid shared global state. Use isolated instances and temporary environment values.

Design Safe Hot Reload

Design a production Viper reload flow that debounces events, decodes a candidate, validates it, and atomically updates synchronized application state.

最佳實務

Configure the environment prefix and key replacer before enabling automatic environment lookup.
Use explicit mapstructure tags and validate decoded configuration before application startup or reload.
Create a separate Viper instance for each test and protect shared runtime configuration with synchronization.

避免

Do not rely on the global Viper instance across tests because state persists between cases.
Do not ignore every ReadInConfig error because malformed or unreadable files require attention.
Do not update shared configuration directly from a watch callback without validation and synchronization.