What problem does it solve? Go codebases handling untrusted input, credentials, or network traffic often contain exploitable vulnerabilities — SQL injection, hardcoded secrets, weak crypto, missing security headers — that slip through ordinary code review. This Skill provides a structured methodology to map trust boundaries, trace data flows, and systematically check every vulnerability class before code ships. ## Core Features & Use Cases - Three operational modes: review a PR diff for vulnerabilities, run a full codebase security audit by domain, or write new code with safe defaults from the start. - Vulnerability quick reference: severity-ranked tables covering SQL injection, command injection, XSS, path traversal, timing attacks, crypto misuse, race conditions, and more, each paired with the correct Go standard library defense. - DREAD scoring and reporting: rank findings Critical/High/Medium/Low with documented severity adjustments and inline // security: comments. - Deep-dive references: twelve focused guides on cryptography, injection, filesystem, network, cookies, secrets, logging, memory safety, third-party data leaks, threat modeling (STRIDE/OWASP), architecture, and a review checklist. - Use Case: Before merging a PR that adds a file-upload endpoint, use this Skill to trace the filename input to its origin, verify os.Root scoping against path traversal, check for decompression bomb limits, and confirm gosec and govulncheck pass. ## Quick Start Use the go-security skill to audit this Go pull request for injection, crypto, and secrets vulnerabilities and report findings ranked by severity.
