Name: golang-security
Rating: 90.2 (1 reviews)
Author: samber

golang-security

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

1.13x

Quality

89%

Does it follow best practices?

Impact

91%

1.13x

Average score across 3 eval scenarios

Securityby

Passed

No findings from the security scan

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, actionable security skill body that uses compact tables and executable commands, offloads detail to a flat set of clearly-labeled reference files, and sequences the core review workflow clearly. The only gap is a missing explicit validation feedback loop for the fix-application workflow.

Suggestions

Add an explicit validate-then-commit checkpoint to the fix-application/worktree workflow (e.g., 'run gosec/govulncheck/-race in the worktree, only open the PR when checks pass') to close the validation loop for destructive/batch changes.

Tighten the Overview paragraph to remove the generic defense-in-depth framing that restates what the rest of the skill already demonstrates.

Consider noting the Go version dependency for 'os.Root' (Go 1.24+) inline in the Quick Reference rather than only in the path-traversal row, since it governs which defense to apply.

Dimension	Reasoning	Score
Conciseness	Mostly lean with compact tables conveying vulnerability/defense/fix pairs and executable commands; a few generic framing sentences (e.g., 'Security in Go follows the principle of defense in depth...') could be trimmed, but no padding of basic concepts.	4 / 5
Actionability	Provides concrete executable commands ('go tool gosec ./...', 'go test -race ./...', 'go test -fuzz=Fuzz') and specific standard-library solutions in tables (e.g., 'crypto/subtle.ConstantTimeCompare', 'os.Root', 'exec.Command with separate args') covering common cases.	5 / 5
Workflow Clarity	The 'Research Before Reporting' section gives a clear numbered sequence with severity-adjustment guidance, and Audit mode defines fan-out/synthesis/DREAD scoring; however the fix-application workflow (worktrees) lacks an explicit validate-before-commit feedback loop, leaving a minor checkpoint gap.	4 / 5
Progressive Disclosure	SKILL.md is a clear overview pointing to 12 verified one-level-deep reference files, each signaled with descriptive link text and rationale (e.g., 'Cryptography — Algorithms, key derivation, TLS configuration'), with no nested reference chains.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what the skill does, when to invoke it, and where its boundaries lie with explicit redirects to sibling skills. Trigger phrasing is natural and the scope is comprehensive yet distinct.

Dimension	Reasoning	Score
Specificity	Enumerates many concrete security domains and actions — 'injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus gosec SAST, race detection, and fuzz testing' — giving comprehensive, specific coverage.	5 / 5
Completeness	Explicitly answers both what ('Security best practices and vulnerability prevention for Golang' with enumerated domains) and when ('Apply when writing, reviewing, or auditing Go code for security'), plus an explicit out-of-scope clause.	5 / 5
Trigger Term Quality	Natural triggers like 'writing, reviewing, or auditing Go code for security' and 'touching crypto, file or network I/O, secrets, user input, or authentication' map well to user phrasing, though coverage leans technical and a few common phrasings are implicit rather than stated.	4 / 5
Distinctiveness Conflict Risk	Clear Go-security niche with explicit boundary guidance redirecting overlapping concerns (nil panics → golang-safety, govulncheck → golang-dependency-management, CI scanners → golang-continuous-integration), minimizing wrong-skill triggers.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_field	'metadata' should map string keys to string values	Warning

	Total	15 / 16 Passed

Repository: samber/cc-skills-golang
Path: skills/golang-security/SKILL.md
Commit: 19a0626

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.