golang-security

Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging. Apply when writing, reviewing, or auditing Go code for security, or when working on any risky code involving crypto, I/O, secrets management, user input handling, or authentication. Includes configuration of security tools.

0.98x

Quality

80%

Does it follow best practices?

Impact

98%

0.98x

Average score across 1 eval scenario

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/golang-security/SKILL.md

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Well-structured, actionable body with strong progressive disclosure via real reference files and concrete stdlib/command guidance. The main weakness is conciseness — several prose sections explain security concepts Claude already knows.

Suggestions

Tighten the prose in 'Overview' and 'Threat Modeling (STRIDE)' to reference-only density, since Claude already knows defense-in-depth and the STRIDE acronym; keep the DREAD severity table.

Add an explicit validation/verification checkpoint to the Coding-mode fix workflow (e.g., re-run gosec/govulncheck/-race after a fix and only mark resolved when clean).

Move the 'Security Thinking Model' three-question preamble into the threat-modeling reference or compress it to a one-line pointer, reducing concept restatement.

Dimension	Reasoning	Score
Conciseness	Dense, table-driven content is token-efficient, but prose sections restate concepts Claude already knows ('Security in Go follows the principle of defense in depth...', STRIDE acronym expansion, DREAD definitions) and could be tightened.	3 / 5
Actionability	Provides concrete stdlib mappings ('database/sql with ? placeholders', 'exec.Command with separate args', 'os.Root') and executable commands ('go tool gosec ./...', 'go tool govulncheck ./...', 'go test -race ./...'), with detailed code deferred to references.	4 / 5
Workflow Clarity	Clear sequenced modes (Review/Audit/Coding) and a 'Research Before Reporting' workflow with explicit validation steps (trace data origin, check upstream validation, examine trust boundary); minor validation gaps in the fix-application path.	4 / 5
Progressive Disclosure	A clear overview with 12 well-signaled, one-level-deep reference links ('[Cryptography](./references/cryptography.md)', etc.), each with a descriptive blurb; all referenced files exist in ./references/ and content is appropriately split.	5 / 5
	Total	16 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that explicitly covers both what the skill does and when to apply it, with concrete domain coverage and natural trigger terms. The only weakness is minor overlap risk with sibling Go skills.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete domains and actions — 'injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging' plus 'writing, reviewing, or auditing Go code' and 'configuration of security tools' — giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers what ('Security best practices and vulnerability prevention for Golang...') and when ('Apply when writing, reviewing, or auditing Go code for security, or when working on any risky code involving crypto, I/O, secrets management, user input handling, or authentication').	5 / 5
Trigger Term Quality	Good natural-term coverage ('security', 'Go code', 'Golang', 'crypto', 'secrets', 'authentication', 'auditing', 'injection') with both 'Go' and 'Golang' synonyms present, but a few common phrasings a user might say are absent.	4 / 5
Distinctiveness Conflict Risk	The Go-security niche is clear and well-scoped, but the body cross-references closely related sibling skills (golang-safety, golang-database), indicating minor overlap risk with adjacent Go skills.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_field	'metadata' should map string keys to string values	Warning

	Total	15 / 16 Passed

Repository: samber/cc-skills-golang
Path: skills/golang-security/SKILL.md
Commit: 30cdf15

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.