skills.rest
2877389577
2877389577COMMUNITY
Explore all skills by this author →
GitHub

golang-security

Audit and write Go code against injection, cryptography, filesystem, and web security vulnerabilities.

Updated Jun 15, 2026
Search Tags:#code review#security#vulnerability#sql injection#go#cryptography#govulncheck
One-click install
npx skills add https://github.com/2877389577/novels_ai_gen --skill golang-security-2877389577
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-security
Source: https://github.com/2877389577/novels_ai_gen/tree/main/.agents/skills/golang-security
Command: npx skills add https://github.com/2877389577/novels_ai_gen --skill golang-security-2877389577

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, and includes references (resource) components.

What problem does it solve? Go codebases frequently ship with preventable vulnerabilities like SQL injection, weak cryptography, path traversal, and leaked secrets. This Skill gives an AI coding agent a structured security methodology — threat modeling, severity scoring, and per-domain rules — so security issues are caught during writing, review, and auditing rather than after deployment. ## Core Features & Use Cases - Three operating modes: Review mode for PR security analysis, Audit mode launching up to 5 parallel sub-agents across vulnerability domains, and Coding mode for writing secure new code. - Comprehensive vulnerability coverage: Injection (SQL, command, XSS, SSRF), cryptography (AES-GCM, Argon2id, TLS), filesystem safety (path traversal, zip bombs), cookies, secrets management, memory safety, and logging hygiene, each with bad/good Go code examples and CWE mappings. - Threat modeling and scoring: STRIDE analysis at trust boundaries with DREAD-based severity levels (Critical through Low) to prioritize remediation. - Tooling integration: Guidance for gosec, govulncheck, race detector, and fuzz testing. - Use Case: When reviewing a pull request that adds a file-serving endpoint, the agent traces the filename input back to its origin, flags missing os.Root confinement as a High path traversal finding, and provides the corrected Go 1.24 implementation. ## Quick Start Ask the agent to audit your Go project for security vulnerabilities using the golang-security skill and report findings by severity.

Frequently Asked Questions about golang-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in Go?▼

Use parameterized queries with placeholders ($1 for pgx/lib/pq, ? for MySQL/SQLite) so user data never mixes with query logic. For dynamic IN clauses, generate numbered placeholders; for dynamic column names or ORDER BY, validate against an explicit allowlist since placeholders only work for values.

How do I securely hash passwords in Go?▼

Use Argon2id via golang.org/x/crypto/argon2 with OWASP-recommended parameters (3 iterations, 64MB memory), or bcrypt for a simpler API. Never use MD5, SHA1, or plain SHA-256, which are fast enough to brute-force. Note that Go's bcrypt errors on passwords over 72 bytes.

How do I prevent path traversal when serving files in Go?▼

On Go 1.24+, use os.OpenRoot to confine all file operations to an allowed root directory, which rejects escaping paths and symlinks at the OS level. For older Go, combine filepath.IsLocal with filepath.Rel and separator-aware checks; never rely on filepath.Clean plus strings.HasPrefix alone.

Does this skill work with govulncheck and gosec?▼

Yes, the skill integrates both tools: gosec for static security analysis (SAST) and govulncheck for scanning known CVEs in the dependency tree. It also covers running the race detector with go test -race and fuzz testing as part of security verification.

Why is math/rand dangerous for security tokens in Go?▼

math/rand is a deterministic PRNG whose output is predictable once the seed or enough output is observed, even if seeded from crypto/rand. Session tokens, keys, and nonces must be generated with crypto/rand.Read directly, and the error return must be handled.

What are the limitations of AES-GCM nonce handling in Go?▼

Reusing a nonce with AES-GCM catastrophically breaks both confidentiality and authentication. Counter-based nonces fail across multiple service instances or restarts, so generate a fresh random 96-bit nonce with crypto/rand per encryption and prepend it to the ciphertext.

Related Skills

Explore More Software Engineering Skills→
dashkandashkan
1

golang-lint

Configure golangci-lint v2 and manage nolint suppressions for Go code.

Community
Intermediate
MolcajeteAIMolcajeteAI
2

security-scanning

Scan Go projects with gosec and govulncheck for security vulnerabilities.

Official
Intermediate
QunnnnQunnnn

go-observability

Standardize Go service logs, metrics, and traces with slog, Prometheus, and OpenTelemetry.

Community
Intermediate
fjor1025fjor1025

audit-prep-assistant

Prepares codebases for security audits by running static analysis and generating documentation.

Community
Advanced