skills.rest
VerifiedOrganic
VerifiedOrganicCOMMUNITY
Explore all skills by this author →
GitHub

golang-security

Audit and write Go code against injection, cryptography, and web security vulnerabilities.

1|Updated Jun 2, 2026
Search Tags:#code review#security#vulnerability#audit#injection#go#cryptography
One-click install
npx skills add https://github.com/VerifiedOrganic/onboard --skill golang-security-verifiedorganic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-security
Source: https://github.com/VerifiedOrganic/onboard/tree/main/.agents/skills/golang-security
Command: npx skills add https://github.com/VerifiedOrganic/onboard --skill golang-security-verifiedorganic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, and includes references (resource) components.

What problem does it solve? Go codebases often ship with subtle security flaws — SQL injection, weak cryptography, path traversal, leaked secrets — that surface only after a breach. This Skill gives an AI agent a structured security engineering workflow to review, audit, and write Go code that resists these vulnerability classes. ## Core Features & Use Cases - Three operating modes: Review mode for PR security analysis, Audit mode that launches parallel sub-agents across five vulnerability domains with DREAD severity scoring, and Coding mode for writing secure new code. - Comprehensive vulnerability coverage: Injection (SQL, command, XSS, SSRF), cryptography (AES-GCM, Argon2id, TLS), filesystem safety (path traversal, ZipSlip), cookies, secrets management, logging, and memory safety — each with bad/good Go code examples and CWE mappings. - Threat modeling and checklists: STRIDE/DREAD methodology, a full security review checklist, and tooling guidance for gosec, govulncheck, race detection, and fuzz testing. - Use Case: Point your agent at a Go pull request and ask for a security review — it traces data flows beyond the diff, flags a SQL concatenation reachable from user input, scores it with DREAD, and suggests the parameterized-query fix. ## Quick Start Ask your agent to run a security audit of this Go repository using the golang-security skill and report findings by severity.

Frequently Asked Questions about golang-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Go code for security vulnerabilities?▼

Run a full codebase audit that launches parallel sub-agents across five domains: injection, cryptography and secrets, web security, authentication, and concurrency. Findings are scored with DREAD and reported by severity from Critical to Low.

How to prevent SQL injection in Go database queries?▼

Use parameterized queries with placeholders ($1 for pgx, ? for MySQL) so user data never mixes with query logic. For dynamic IN clauses, generate numbered placeholders; for dynamic column names, use an explicit allowlist since placeholders cannot bind identifiers.

What password hashing algorithm should Go applications use?▼

Use Argon2id as the preferred password hash because it is memory-hard and resists GPU attacks, with bcrypt as a simpler alternative. Never use MD5, SHA1, or plain SHA-256, which are fast enough to brute-force.

Does Go 1.24 help prevent path traversal vulnerabilities?▼

Yes, Go 1.24 adds os.Root, which confines file operations to a root directory at the OS level and rejects escaping symlinks. For earlier versions, combine filepath.IsLocal with filepath.Rel and separator-aware checks instead of relying on Clean plus HasPrefix.

Why is math/rand unsafe for generating session tokens in Go?▼

math/rand is a deterministic PRNG, so once an attacker observes enough output or infers the seed, all future tokens become predictable — even if seeded from crypto/rand. Security-critical randomness must come from crypto/rand directly.

What tools check Go dependencies for known CVEs?▼

govulncheck scans your dependency tree for known vulnerabilities and reports only reachable ones. Combine it with gosec for static security analysis, the race detector for concurrency flaws, and fuzz testing for input handling.

Related Skills

Explore More Software Engineering Skills→
bluejayAbluejayA
2

aidlc-using-git-worktrees

Create an isolated git worktree before code generation begins.

Community
Intermediate
dmwin72015dmwin72015
1

golang-continuous-integration

Configure GitHub Actions CI/CD pipelines for Go projects with testing, linting, and security scanning.

Community
Advanced
provenimpactprovenimpact

needs-dependencies

Detect package managers and update outdated, vulnerable, or license-violating dependencies.

Official
Advanced
wodsmithwodsmith
2

review

Load persona references and produce structured multi-perspective code reviews.

Official
Advanced