go-vuln-ssrf-requestforgery

Audit Go code for SSRF, XSS, and CSRF vulnerabilities.

74|10|Updated Mar 5, 2026

Search Tags:#xss #go #web security #vulnerability scanning #csrf #ssrf

Ready to run

npx skills add https://github.com/yhy0/ghsa-skill-builder --skill go-vuln-ssrf-requestforgery

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: go-vuln-ssrf-requestforgery
Source: https://github.com/yhy0/ghsa-skill-builder/tree/main/vuln-skills/skills/go-vuln-ssrf-requestforgery
Command: npx skills add https://github.com/yhy0/ghsa-skill-builder --skill go-vuln-ssrf-requestforgery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) vulnerabilities in Go applications, protecting against common web exploits.

Core Features & Use Cases

SSRF Detection: Identifies insecure handling of user-provided URLs in HTTP requests and network calls.
XSS Prevention: Detects vulnerabilities arising from improper HTML rendering of user input, especially via template type assertions.
CSRF Mitigation: Checks for missing CSRF protection mechanisms on state-changing endpoints.
Use Case: When auditing a Go web service, load this Skill to systematically check for SSRF risks in webhook integrations, XSS in user-facing templates, and CSRF flaws in API endpoints.

Quick Start

Use the go-vuln-ssrf-requestforgery skill to audit the provided Go code for SSRF, XSS, and CSRF vulnerabilities.

Frequently Asked Questions about go-vuln-ssrf-requestforgery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan Go code for SSRF vulnerabilities in webhook callbacks?▼

Scanning Go code for SSRF vulnerabilities involves auditing HTTP client usage and network calls to identify insecure handling of user-provided URLs in webhook callbacks and URL processing logic.

How do I detect XSS vulnerabilities in Go HTML templates?▼

Detecting XSS vulnerabilities in Go HTML templates requires analyzing template rendering and type assertions to find improper rendering of user input that could lead to code injection.

How do I check for missing CSRF protection on state-modifying Go API endpoints?▼

Checking for missing CSRF protection on Go API endpoints involves analyzing state-changing routes to verify if adequate CSRF mitigation mechanisms are implemented to prevent cross-site request forgery.

Does this vulnerability scanner work with standard Go web services and API endpoints?▼

Yes, this vulnerability scanner works with standard Go web services by analyzing HTTP client usage, template rendering, and API endpoint protection mechanisms to systematically assess web security risks.

What is the best way to systematically audit a Go web service for common web vulnerabilities?▼

The best way to systematically audit a Go web service for common web vulnerabilities is to analyze HTTP client usage for SSRF, template rendering for XSS, and endpoint protection for CSRF across the codebase.

Why does unsafe URL handling in Go HTTP clients cause SSRF vulnerabilities?▼

Unsafe URL handling in Go HTTP clients causes SSRF vulnerabilities because passing unvalidated user input directly to network calls allows attackers to target internal systems via webhook callbacks or URL fetching.