go-vuln-injection

Analyze Go code for injection vulnerabilities and trace data flow from sources to sinks.

74|10|Updated Mar 5, 2026

Search Tags:#security #vulnerability #sql injection #injection #go #command injection

Ready to run

npx skills add https://github.com/yhy0/ghsa-skill-builder --skill go-vuln-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: go-vuln-injection
Source: https://github.com/yhy0/ghsa-skill-builder/tree/main/vuln-skills/skills/go-vuln-injection
Command: npx skills add https://github.com/yhy0/ghsa-skill-builder --skill go-vuln-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and prevent injection vulnerabilities in Go applications, protecting against command injection, SQL injection, and template injection.

Core Features & Use Cases

Source Identification: Detects user input from various sources like HTTP requests, gRPC, and configuration files.
Sink Analysis: Analyzes dangerous operations such as exec.Command, database queries, and template rendering.
Sanitization Verification: Checks for proper security measures like parameterized queries and safe function usage.
Use Case: Audit a Go web service to ensure that user-provided data in API endpoints cannot be used to execute arbitrary shell commands or manipulate SQL databases.

Quick Start

Use the go-vuln-injection skill to audit the provided Go source code for injection vulnerabilities.

Frequently Asked Questions about go-vuln-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect SQL injection vulnerabilities in Go code?▼

To detect SQL injection in Go code, scan for insecure database/sql operations by tracing data flow from HTTP requests and gRPC inputs to query sinks, verifying that parameterized queries are used for sanitization.

What is the best way to audit a Go web service for command injection?▼

The best way to audit a Go web service for command injection is to analyze dangerous operations like exec.Command, tracing user input from configuration files and API endpoints to identify unsanitized shell execution.

How do I check for template injection vulnerabilities in Go applications?▼

To check for template injection in Go applications, analyze text/template rendering operations by tracing user-provided data from sources to template sinks and verifying proper sanitization methods are applied.

How does data flow tracing work for Go injection vulnerabilities?▼

Data flow tracing for Go injection vulnerabilities works by mapping user input from HTTP requests, gRPC, and configuration files to dangerous sinks like exec.Command and database queries, verifying sanitization at each step.

Can I audit Go code for injection vulnerabilities without additional dependencies?▼

Yes, you can audit Go code for injection vulnerabilities without additional dependencies by scanning source code directly for insecure exec.Command, database/sql, and text/template operations and tracing data flow.