CtrlK
BlogDocsLog inGet started
Tessl Logo

golang-dependency-management

Dependency management strategies for Golang projects — go.mod management, installing/upgrading packages, Minimal Version Selection, vulnerability scanning, outdated dependency tracking, binary size analysis, Dependabot/Renovate setup, conflict resolution, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, auditing vulnerabilities, resolving version conflicts, or setting up automated dependency updates.

72

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is well-structured and highly actionable, with clean progressive disclosure to real reference files. The main gap is a missing explicit feedback loop for the vulnerability-scanning step in the upgrade workflow.

Suggestions

Add an explicit feedback loop after `govulncheck ./...` (e.g., 'If vulnerabilities are found, list them, assess severity, and ask whether to upgrade the affected module before proceeding').

Trim a few rationale asides like 'Without it, a compromised proxy could silently substitute malicious code' to keep the body token-efficient without losing the safety signal.

Move the multi-paragraph vendoring rationale to a sentence or relocate it to references if it needs fuller justification.

DimensionReasoningScore

Conciseness

The body is largely lean — tables of commands, copy-paste bash blocks, and terse rules — but includes a few rationale asides that over-explain slightly (e.g., 'Without it, a compromised proxy could silently substitute malicious code' and the vendoring rationale paragraph).

4 / 5

Actionability

Guidance is fully executable: concrete `go get` invocations with version/commit syntax, a complete `go.mod` `tool` directive example, and an end-to-end upgrade command sequence covering the common cases.

5 / 5

Workflow Clarity

The upgrade workflow is clearly sequenced (`go get -u=patch` → `go mod tidy` → `go test` → `go vet` → `govulncheck`) and adding a dependency has an explicit user-confirmation checkpoint, but the vulnerability-scan step lacks an explicit validate/feedback loop (what to do when govulncheck reports issues).

4 / 5

Progressive Disclosure

The body is a clear overview with six well-signaled, one-level-deep reference links (versioning, auditing, conflicts, workspaces, automated-updates, visualization), all pointing to real files in ./references/ with no nested-chaining.

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong, third-person description that pairs a comprehensive capability list with an explicit 'Use when' trigger clause. Minor room to add user-natural synonyms and file-token triggers like 'go.mod' or 'go get'.

DimensionReasoningScore

Specificity

The description lists many concrete capabilities — 'go.mod management, installing/upgrading packages, Minimal Version Selection, vulnerability scanning, outdated dependency tracking, binary size analysis, Dependabot/Renovate setup, conflict resolution, and go.work workspaces' — giving comprehensive coverage of distinct actions.

5 / 5

Completeness

It explicitly answers both 'what' (the enumerated capability list) and 'when' ('Use when adding, removing, or upgrading Go dependencies, auditing vulnerabilities, resolving version conflicts, or setting up automated dependency updates').

5 / 5

Trigger Term Quality

The 'Use when' clause surfaces natural phrases such as 'adding, removing, or upgrading Go dependencies, auditing vulnerabilities, resolving version conflicts,' but lacks some natural synonyms and concrete trigger tokens (e.g., 'go get', 'go.mod', 'go.sum', 'go.work' as trigger words) users would say.

4 / 5

Distinctiveness Conflict Risk

It carves a clear niche — Golang dependency management — with distinct, Go-specific trigger phrases, making overlap with unrelated skills minimal.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_field

'metadata' should map string keys to string values

Warning

Total

15

/

16

Passed

Repository
samber/cc-skills-golang
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.