dancon-secure-coder-go
ALWAYS use this skill whenever generating, writing, reviewing, editing, or modifying Go (.go) code in any context. This skill ensures all generated Go code avoids the CWE Top 25 2025 weaknesses that apply to Go, and that every piece of Go code includes appropriate input validation, thorough error handling, and safe error messages that never leak passwords, tokens, API keys, or other secrets. The Go `unsafe` package is absolutely prohibited and must never appear in generated code. Trigger on ANY Go code generation -- there are no exceptions. Even trivial examples and one-off snippets must follow these rules. If the user asks for Go code, read this skill first.
87
83%
Does it follow best practices?
Impact
94%
1.14xAverage score across 3 eval scenarios
Passed
No known issues
Quality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a reasonably well-crafted description with very strong trigger terms and completeness, clearly stating both what the skill does and when to use it. Its main weaknesses are that the capabilities described are more about constraints and coding practices than discrete concrete actions, and its extremely broad trigger scope ('ANY Go code generation') could create conflicts with other Go-related skills. The use of imperative/second-person voice ('ALWAYS use this skill', 'read this skill first') is slightly unconventional but doesn't use first or second person pronouns in a penalizable way.
Suggestions
Consider listing more specific concrete actions (e.g., 'Validates input boundaries, sanitizes user-supplied strings, wraps errors with context') rather than general categories like 'input validation' and 'error handling'.
Narrow the distinctiveness by clarifying this is specifically a secure coding / security hardening skill for Go, to reduce potential conflict with other Go skills that might focus on style, performance, or architecture.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | The description names the domain (Go code) and several actions (generating, writing, reviewing, editing, modifying), and mentions specific practices like input validation, error handling, safe error messages, and prohibition of the `unsafe` package. However, the actions are more about coding practices/constraints than concrete discrete capabilities, making it somewhat but not fully specific. | 2 / 3 |
Completeness | Clearly answers both 'what' (ensures Go code avoids CWE Top 25 weaknesses, includes input validation, error handling, safe error messages, prohibits `unsafe` package) and 'when' ('ALWAYS use this skill whenever generating, writing, reviewing, editing, or modifying Go (.go) code in any context', 'Trigger on ANY Go code generation'). The 'when' clause is explicit and emphatic. | 3 / 3 |
Trigger Term Quality | Includes strong natural trigger terms: 'Go', '.go', 'Go code', 'generating', 'writing', 'reviewing', 'editing', 'modifying'. These are terms users would naturally use when requesting Go code work. Also mentions specific security concepts like 'CWE Top 25', 'input validation', 'error handling', 'passwords', 'tokens', 'API keys'. | 3 / 3 |
Distinctiveness Conflict Risk | While it's clearly scoped to Go code specifically (not general coding), it could overlap with other security-focused skills or general Go coding skills. The security focus helps distinguish it somewhat, but the broad 'ANY Go code generation' trigger means it would fire for all Go-related requests, potentially conflicting with more specialized Go skills. | 2 / 3 |
Total | 10 / 12 Passed |
Implementation
85%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a well-structured, token-efficient security skill that leverages tables and checklists effectively. Its main strength is the progressive disclosure pattern — a scannable quick-reference table backed by detailed reference files. The primary weakness is the absence of inline executable code examples in the main body, relying entirely on reference files for concrete code, which slightly reduces immediate actionability.
Suggestions
Add 1-2 brief inline Go code examples for the most common patterns (e.g., parameterized SQL query, safe error handling) to improve actionability without needing to consult reference files.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Every section earns its place. The table format is extremely token-efficient for conveying CWE-to-rule mappings. No unnecessary explanations of what CWEs are or how Go works. The checklist is dense but each item is actionable and non-obvious. | 3 / 3 |
Actionability | The quick-reference table provides specific functions and patterns (e.g., `filepath.Abs + strings.HasPrefix`, `exec.Command(name, arg1, arg2)`), and the checklist is concrete. However, the skill itself contains no executable code examples — those are deferred to reference files. The rules are specific enough to act on but lack copy-paste-ready code snippets in the main body. | 2 / 3 |
Workflow Clarity | The mandatory checklist at the end provides a clear validation workflow with an explicit feedback loop: 'If any check fails, fix the issue and re-run the full checklist before presenting code.' The sequence is clear: apply rules → write code → run checklist → fix if needed → re-run checklist. This is appropriate for a code generation skill. | 3 / 3 |
Progressive Disclosure | Excellent structure: quick-reference table for fast lookup, core principles for orientation, and clearly signaled one-level-deep references to three specific files (cwe-web.md, cwe-system.md, error-and-input.md) with explicit content descriptions. The instruction 'Read these when the quick-reference table is insufficient' perfectly signals when to drill down. | 3 / 3 |
Total | 11 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- danielyan-consulting/skills
- Commit
99b52ce
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.