go-security

Identify Go security vulnerabilities from OWASP findings and CVEs in local scans.

Updated Aug 23, 2026
One-click install
npx skills add https://github.com/kengou/go-guardian --skill go-security-kengou
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: go-security
Source: https://github.com/kengou/go-guardian/tree/main/skills/go-security
Command: npx skills add https://github.com/kengou/go-guardian --skill go-security-kengou

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security reviewers automate Go project vulnerability scanning, prioritize OWASP top-10 findings, and correlate CVEs with a project scan cache to reduce toil.

Core Features & Use Cases

  • OWASP & CVE scanning: Integrates with govulncheck and in-project scan cache to surface security hotspots.
  • Threat modeling & governance: Guides security reviews and decision making for Go code paths like crypto, auth, and secret handling.
  • Automated enrichment: Leverages learned patterns to contextualize findings in the MCP workflow.

Quick Start

Run a security scan on your Go project and review the generated findings in the inbox.

Frequently Asked Questions about go-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Go project for OWASP and CVE vulnerabilities?

Scanning a Go project for OWASP and CVE vulnerabilities involves running govulncheck on local code paths like crypto and auth, then enriching the results with learned patterns to deliver structured security findings.

What is govulncheck used for in Go security reviews?

In Go security reviews, govulncheck provides authoritative CVE scanning results, which are then correlated with an in-project scan cache to prioritize and remediate vulnerabilities in code paths like crypto and secret handling.

Can I automate Go vulnerability scanning for release readiness?

Yes, you can automate Go vulnerability scanning for release readiness by evaluating files that touch crypto, authentication, or secret handling paths, which generates structured inbox items to guide security assessments.

Does this Go security scanning approach work with existing project caches?

Yes, this Go security scanning approach works with existing project caches by reading scan artifacts directly from a local .go-guardian directory to correlate and enrich findings within the MCP workflow.

When do I need to run a Go security scan for OWASP findings?

You need to run a Go security scan for OWASP findings during code reviews, security assessments, and release readiness, especially when modifications touch crypto, authentication, or secret handling code paths.