golang-security

Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging. Apply when writing, reviewing, or auditing Go code for security, or when working on any risky code involving crypto, I/O, secrets management, user input handling, or authentication. Includes configuration of security tools.

1.39x

Quality

85%

Does it follow best practices?

Impact

96%

1.39x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Evaluation results

100%

11%

User Authentication Microservice

Secure user authentication implementation

Criteria

Without context

With context

Memory-hard password hash

100%

Cryptographic session token

100%

Cookie HttpOnly flag

100%

Cookie Secure flag

100%

Cookie SameSite attribute

100%

Secrets from environment

100%

No PII in logs

100%

Generic client error messages

100%

HTTP server timeouts

100%

Per-client rate limiting

100%

Request body size limit

62%

100%

Security response headers

100%

90%

30%

User File Processing Service

Safe file upload and ZIP extraction

Criteria

Without context

With context

os.Root for file access

100%

ZipSlip prevention

100%

Decompression size limit

100%

Secure temp file creation

100%

Temp file cleanup

100%

Restrictive file permissions

100%

exec.Command separate args

100%

Filename validation before exec

100%

Request body size limit

100%

37%

No internal paths in errors

100%

37%

100%

40%

Security Review: Stripe Webhook Integration Service

Security audit methodology and threat modeling

Criteria

Without context

With context

STRIDE categories applied

100%

DREAD severity scores

100%

XXE vulnerability identified

100%

SQL injection identified

100%

Hardcoded secret identified

100%

Error detail leakage identified

100%

PII/log injection in logs identified

100%

Severity adjustment for getCustomerByID

100%

Inline security comment recommended

100%

Data flow traced

100%

HTTP server hardening identified

100%

Findings report file produced

100%

Repository: samber/cc-skills-golang
Commit: b88f91d

Evaluated: 3 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

User Authentication Microservice User File Processing Service Security Review: Stripe Webhook Integration Service

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.