golang-security

82 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By samber/cc-skills-golang (GitHub) · coding · 3,824 stars · scanned at commit d68d80a

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as ni…

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 1 place.

skills/golang-security/SKILL.md, line 40- govulncheck: `go install golang.org/x/vuln/cmd/govulncheck@latest`

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 4 places.

skills/golang-security/SKILL.md, line 131go get -tool github.com/securego/gosec/v2/cmd/gosec@latest
skills/golang-security/SKILL.md, line 145go test -race ./...
skills/golang-security/SKILL.md, line 157| Critical | `exec.Command("bash -c")` | Shell interprets metacharacters (`;`, `\|`, `` ` ``). Pass args separately to avoid shell parsing |

Show 1 more

skills/golang-security/evals/evals.json, line 83{"id": "6.4", "text": "Does NOT pass the user's script fragment to 'sh -c' or 'bash -c' with string concatenation"},

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'golang-security' ] || [ -L ~/.agents/skills/'golang-security' ]; then echo 'A skill folder named golang-security already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/samber/cc-skills-golang' "$d" && git -C "$d" checkout --quiet 'd68d80aec298e1b74b37c2a472c002b5217248b3' -- 'skills/golang-security' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/golang-security' ~/.agents/skills/'golang-security' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'golang-security' ~/.claude/skills/'golang-security' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for samber/cc-skills-golang shows the score of its lowest-scoring skill.

SkillTrust badge for samber/cc-skills-golang

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/samber/cc-skills-golang.svg)](https://zalavijaysinh.github.io/skilltrust/repos/samber/cc-skills-golang/)

Score history

Date	Version	Score
2026-11-11	`d68d80a`	82
2026-11-08	`bb1d43d`	82
2026-11-07	`bb1d43d`	82