skills.rest
adibfirman
adibfirmanCOMMUNITY
Explore all skills by this author →
Website𝕏@adibfirman_GitHub

golang-security

Review Go code for security vulnerabilities using STRIDE/DREAD threat modeling.

2|Updated Feb 12, 2024
Search Tags:#secure coding#threat modeling#golang#security review#secrets management#injection prevention#crypto correctness
One-click install
npx skills add https://github.com/adibfirman/dotfiles --skill golang-security-adibfirman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-security
Source: https://github.com/adibfirman/dotfiles/tree/main/claude/.claude/skills/technical/golang/golang-security
Command: npx skills add https://github.com/adibfirman/dotfiles --skill golang-security-adibfirman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you write, review, and audit Go code with strong security guardrails so common real-world vulnerabilities are prevented early instead of discovered after deployment.

Core Features & Use Cases

  • Threat-model-driven security reviews: Apply STRIDE + DREAD scoring to prioritize findings based on real impact and exploitability.
  • Go-specific vulnerability coverage: Addresses injection risks (SQL/command/XSS), cryptography correctness, filesystem/path safety, network/web issues, cookies, secrets management, memory/race safety, and secure logging.
  • Tooling & verification guidance: Recommends practical checks such as govulncheck, Go race testing, and security-focused linting/verification steps during audits and fixes.
  • Use Case: You are reviewing a Go service endpoint that processes user input and performs database queries and file operations; use this skill to trace trust boundaries end-to-end and produce a prioritized remediation plan.

Quick Start

Review the attached Go pull request for security issues using the golang-security guidance and produce a severity-ranked checklist of fixes.

Frequently Asked Questions about golang-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security review on Go code?▼

A Go security audit identifies vulnerabilities by tracing data flows across trust boundaries using STRIDE/DREAD methodologies, validating safe crypto choices, scoped filesystem access, and hardened HTTP behavior to produce a prioritized remediation plan.

What security vulnerabilities are specific to Golang applications?▼

Golang security vulnerabilities include injection risks (SQL, command, XSS), cryptography correctness, filesystem and path traversal risks, insecure network/web behaviors, cookie handling, secrets management, memory race conditions, and leaky error logging.

How do I prevent SQL injection and path traversal in Go endpoints?▼

Prevent SQL injection and path traversal in Go endpoints by applying domain-focused validation tasks, scoping filesystem access, and tracing user input data flows across trust boundaries to ensure safe database queries and file operations.

Can I use threat modeling to audit an existing Go codebase?▼

Yes, you can audit an existing Go codebase by applying threat modeling workflows like STRIDE and DREAD to trace data flows, score finding severity based on real impact and exploitability, and generate a prioritized remediation plan.

What tools should I use to check for Golang vulnerabilities and race conditions?▼

To check for Golang vulnerabilities and race conditions, use govulncheck for dependency scanning, Go race testing for memory safety, and security-focused linting verification steps during audits and code fixes.

Related Skills

Explore More Software Engineering Skills→
securityreviewaisecurityreviewai

project-overview-analysis

Analyzes Git repositories to produce summaries of their structure, risks, and key components.

Official
Intermediate
protofireprotofire
3

protofire-qa-agent

Audit smart contracts with Slither, Echidna, and Foundry fuzz testing.

Official
Advanced
dhruvinrsonidhruvinrsoni

security-review

Review code diffs for OWASP Top 10 vulnerabilities and hardcoded secrets.

Community
Advanced
phatblatphatblat
12

WebAssessment

Automate web application security assessments with reconnaissance, threat modeling, and vulnerability analysis.

Community
Advanced