skills.rest
PremModhaOfficial
PremModhaOfficialCOMMUNITY
Explore all skills by this author →
GitHub

go-dependency-vetting

Vet Go module licenses, CVEs, and size for go get additions.

Updated Aug 27, 2026
Search Tags:#dependencies#go#cve#vetting#licenses#govulncheck
One-click install
npx skills add https://github.com/PremModhaOfficial/go-sdk-pipeline --skill go-dependency-vetting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: go-dependency-vetting
Source: https://github.com/PremModhaOfficial/go-sdk-pipeline/tree/main/.claude/skills/go-dependency-vetting
Command: npx skills add https://github.com/PremModhaOfficial/go-sdk-pipeline --skill go-dependency-vetting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

License, CVE, maintenance, size gate for every new go get. Drives sdk-dep-vet-devil verdicts.

Core Features & Use Cases

  • License checks ensure compliance with module licenses before adoption.
  • CVE checks for known vulnerabilities using govulncheck and osv-scanner integrations.
  • Size gating and maintenance signals prevent oversized or risky dependencies from entering the SDK.
  • Use case: gating dependencies when adding a new client or updating an SDK package.

Quick Start

Run the go-dependency-vetting process on a new module using go get module@version to obtain a vetting verdict.

Frequently Asked Questions about go-dependency-vetting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I vet Go dependencies for CVEs and licenses before adding them?▼

Go dependency vetting automates license compliance, CVE checks via govulncheck and osv-scanner, and size gating for newly added modules. It applies to all go get additions across SDK dependencies, including transitive updates and vendor changes.

Does Go dependency vetting work with transitive updates and vendor changes?▼

Yes, Go dependency vetting applies to all go get additions across SDK dependencies, including transitive updates and vendor changes. This ensures governance and compliance checks are enforced before integration into the SDK.

How do I automate CVE checks for new Go modules using govulncheck?▼

You can automate CVE checks for new Go modules by running the vetting process on a module added via go get module@version. This uses govulncheck and osv-scanner integrations to deliver a deterministic verdict.

What is the best way to enforce size gating and maintenance signals on Go SDK packages?▼

The best way to enforce size gating and maintenance signals on Go SDK packages is through automated dependency vetting. This process prevents oversized or risky dependencies from entering the SDK by delivering a deterministic verdict.

When do I need to run a license and vulnerability check on my Go modules?▼

You need to run a license and vulnerability check whenever adding a new client or updating an SDK package. This vetting process ensures license compliance and CVE checks are completed before module adoption.

Related Skills

Explore More Software Engineering Skills→
kaptinlinkaptinlin
23

multimodule-initializing

Initialize or convert Go libraries into multi-module repositories with go.work.

Community
Intermediate
konflux-cikonflux-ci
8

working-with-provenance

Trace Konflux image provenance to source commits and build logs.

Official
Advanced
j4hr3nj4hr3n

sca-audit

Identify and triage CVEs in project dependencies across multiple ecosystems.

Community
Advanced
chicanoandres702chicanoandres702

dependency-management-deps-audit

Scan dependencies for CVEs, license risks, and supply-chain issues.

Community
Advanced