skills.rest
LuminaVault
LuminaVaultOFFICIAL
Explore all skills by this author →
GitHub

golang-security

Audit and write Go code against injection, cryptography, and web security vulnerabilities.

Updated May 9, 2026
Search Tags:#code review#security#injection#go#cryptography#vulnerability audit#govulncheck
One-click install
npx skills add https://github.com/LuminaVault/LuminaVaultShared --skill golang-security-luminavault
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-security
Source: https://github.com/LuminaVault/LuminaVaultShared/tree/main/.agents/skills/golang-security
Command: npx skills add https://github.com/LuminaVault/LuminaVaultShared --skill golang-security-luminavault

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, gosec, and includes references (resource) components.

What problem does it solve? Go codebases often ship with preventable vulnerabilities like SQL injection, weak cryptography, hardcoded secrets, and missing security headers. This Skill gives an AI agent a structured security methodology — threat modeling, severity scoring, and domain-specific checklists — to review, audit, or write Go code that resists common attack patterns. ## Core Features & Use Cases - Three operating modes: Review mode for PR security analysis, Audit mode that launches parallel sub-agents across five vulnerability domains with DREAD scoring, and Coding mode for writing secure new code. - Comprehensive vulnerability references: Detailed guides covering injection (SQL, command, XSS, SSRF), cryptography (AES-GCM, Argon2id, TLS), filesystem safety (path traversal, ZipSlip), cookies, secrets management, logging, and security architecture patterns. - Tooling integration: Configures gosec, govulncheck, race detector, and fuzz testing for automated verification. - Use Case: Before merging a PR that adds a file-upload endpoint, run an audit to catch path traversal risks, missing request body limits, and insecure file permissions — each finding scored by severity with a concrete fix. ## Quick Start Ask the agent to audit your Go project for security vulnerabilities and report findings ranked by DREAD severity.

Frequently Asked Questions about golang-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Go code for security vulnerabilities?▼

Run a full codebase audit that launches parallel sub-agents across five domains: injection, cryptography and secrets, web security, authentication, and concurrency. Findings are scored with DREAD and reported by severity from Critical to Low.

How to prevent SQL injection in Go database queries?▼

Use parameterized queries with placeholders ($1 for pgx, ? for MySQL) instead of string concatenation. For dynamic IN clauses, generate numbered placeholders; for dynamic column names, validate against an explicit allowlist since placeholders only work for values.

What password hashing algorithm should Go applications use?▼

Use Argon2id as the preferred choice since it is memory-hard and resists GPU attacks, or bcrypt for a simpler API. Avoid MD5, SHA1, and plain SHA-256, which are fast enough to brute-force.

Does Go 1.24 change how to prevent path traversal?▼

Yes, Go 1.24 adds os.Root, which confines file operations to a root directory at the OS level and rejects escaping symlinks. For earlier versions, use filepath.IsLocal plus filepath.Rel with separator-aware checks instead of Clean with HasPrefix.

Why is math/rand unsafe for generating session tokens in Go?▼

math/rand is a deterministic PRNG whose output is predictable once the seed or enough output is observed, even if seeded from crypto/rand. Security-critical randomness like tokens and nonces must come from crypto/rand directly.

What security tools does this skill configure for Go projects?▼

It configures gosec for static security analysis, govulncheck for scanning known CVEs in dependencies, the race detector via go test -race, and Go fuzz testing. It also references security linters like bodyclose and sqlclosecheck.

Related Skills

Explore More Software Engineering Skills→
PeterBookerPeterBooker
23

security-scan

Scan Go projects for security vulnerabilities with gosec and govulncheck.

Community
Intermediate
Rune-kitRune-kit
82

sentinel

Scan code commits for secrets, OWASP top 10 patterns, and dependency vulnerabilities.

Official
Advanced
tokioutokiou
1

golang-lint

Configure and run golangci-lint to detect issues in Go projects.

Community
Intermediate
ArMaTeCArMaTeC

security-reviewer

Identifies code vulnerabilities and generates severity-rated security audit reports with remediation guidance.

Community
Advanced