skills.rest
trypanic
trypanicCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

go-code-quality-check

Run go vet, staticcheck, and semgrep to generate severity-grouped fix plans.

Updated May 5, 2026
Search Tags:#code quality#static analysis#go#pre-commit#security scanning#vulnerability detection#semgrep
One-click install
npx skills add https://github.com/trypanic/skills --skill go-code-quality-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: go-code-quality-check
Source: https://github.com/trypanic/skills/tree/main/go-code-quality-check
Command: npx skills add https://github.com/trypanic/skills --skill go-code-quality-check

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires go, jq, staticcheck, semgrep, docker, and includes scripts (resource) components.

What problem does it solve?

Go developers often have to manually run multiple disjointed tools (go vet, staticcheck, semgrep) to check code quality and security, then spend time aggregating and prioritizing scattered findings to know what to fix first.

Core Features & Use Cases

  • Unified Static Analysis & Security Scanning: Runs go vet, staticcheck, and semgrep in a single command, no manual setup or tool switching required.
  • Prioritized Fix Planning: Automatically groups all findings by file and severity (ERROR, WARNING, INFO) so you can address the most critical issues first.
  • Use Case: Before committing or pushing Go code, run this skill to catch bugs, security vulnerabilities, and style violations all at once, instead of running each tool separately and merging results manually.

Quick Start

Use the go-code-quality-check skill to run a full static analysis and security scan on your current Go project and get a prioritized list of fixes to address.

Frequently Asked Questions about go-code-quality-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run Go static analysis and security scanning together?▼

Run Go static analysis and security scanning together by executing a single command that triggers go vet, staticcheck, and semgrep, automatically aggregating results into a normalized, severity-grouped fix plan.

What's the best way to group Go code quality issues by severity?▼

Group Go code quality issues by severity by running an automated scan that normalizes outputs from go vet, staticcheck, and semgrep into prioritized ERROR, WARNING, and INFO categories.

Can I use semgrep and staticcheck for pre-commit validation in Go projects?▼

You can use semgrep and staticcheck for pre-commit validation in Go projects of any size or structure to catch bugs, security vulnerabilities, and style violations before pushing code.

Do I need Docker to scan Go code for security vulnerabilities?▼

Docker is required as a dependency to scan Go code for security vulnerabilities, alongside jq, to execute the automated static analysis and generate the normalized fix plans.

Why should I automate Go code review with staticcheck instead of running tools manually?▼

Automating Go code review with staticcheck eliminates the manual effort of switching between disjointed tools, merging scattered findings, and prioritizing bugs and security flaws.

When do I need to run a Go security audit before a release?▼

Run a Go security audit before a release to identify vulnerabilities and code quality issues across your project, generating a prioritized list of fixes to ensure release readiness.

Related Skills

Explore More Software Engineering Skills→
JamesPrialJamesPrial
3

go-linting

Route Go linting tasks to vet, staticcheck, and golangci-lint.

Community
Intermediate
RazisafirRazisafir
1

implementing-secret-scanning-with-gitleaks

Implement Gitleaks secret scanning in git repositories with pre-commit hooks and CI/CD integration.

Community
Intermediate
oborchersoborchers
28

tag-based-production-deploys

Enforce git tag-based production deployments with manual approval gates.

Community
Advanced
utkusenutkusen
1.3k

sast-report

Consolidate SAST findings from sast/*-results.md into a prioritized final-report.md.

Community
Intermediate