golang-security

Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging. Apply when writing, reviewing, or auditing Go code for security, or when working on any risky code involving crypto, I/O, secrets management, user input handling, or authentication. Includes configuration of security tools.

1.15x

Quality

85%

Does it follow best practices?

Impact

91%

1.15x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Evaluation results

86%

-4%

Secure Session-Based Web Service

Secure session cookie management in Go

Criteria

Without context

With context

No hardcoded session key

100%

Session key from env

100%

60%

Two keys to NewCookieStore

Cookie HttpOnly

100%

Cookie Secure

100%

Cookie SameSite

100%

Server ReadTimeout

100%

Server WriteTimeout

100%

Server IdleTimeout

100%

No PII in logs

100%

No client header auth trust

100%

Generic error responses

100%

88%

31%

Archive Upload and Extraction Service

Secure ZIP extraction with path traversal and bomb protection

Criteria

Without context

With context

ZipSlip path validation

80%

100%

Decompression size limit

91%

100%

Sentinel error for size limit

100%

os.CreateTemp for temp files

100%

Temp file cleanup

100%

User path confinement

100%

Restrictive file permissions

20%

100%

No strings.HasPrefix traversal check

100%

HTTP server timeouts

Generic error to client

42%

100%

User Authentication API with JWT

JWT auth API with secure SQL, password hashing, and structured logging

Criteria

Without context

With context

Parameterized SQL

100%

Argon2id or bcrypt hashing

100%

No math/rand for secrets

100%

JWT algorithm pinning

100%

JWT secret from env

100%

DB connection from env

100%

No password in logs

100%

Structured logging (slog)

100%

Generic HTTP errors

100%

Constant-time comparison

100%

Server timeouts set

100%

Repository: samber/cc-skills-golang
Commit: a5e0e59

Evaluated: 14 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Secure Session-Based Web Service Archive Upload and Extraction Service User Authentication API with JWT

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.