What problem does it solve? Go codebases often ship with preventable vulnerabilities like SQL injection, weak cryptography, hardcoded secrets, and missing security headers. This Skill gives an AI coding agent a structured security methodology — threat modeling, severity scoring, and domain-specific references — to find, prioritize, and fix these issues during code review, full audits, or new development. ## Core Features & Use Cases - Three operating modes: Review mode for PR security analysis, Audit mode that fans out five parallel sub-agents across vulnerability domains (injection, crypto, web, auth, concurrency) with DREAD severity scoring, and Coding mode for writing secure new code. - Deep reference library: Detailed guides with Go code examples covering cryptography (AES-GCM, Argon2id, TLS), injection (SQL, command, XSS, SSRF), filesystem safety (path traversal, ZipSlip), cookies, secrets management, logging, and security architecture patterns. - Tooling integration: Uses govulncheck, gosec, race detector, and fuzz testing to verify findings, plus a comprehensive severity-tagged review checklist. - Use Case: Ask the agent to audit a Go REST API before launch — it scans for injection flaws, weak TLS config, missing rate limiting, and PII in logs, then reports findings ranked by DREAD severity with concrete fixes. ## Quick Start Ask the agent to perform a security audit of your Go project and report vulnerabilities ranked by severity.
