skills.rest
dashkan
dashkanCOMMUNITY
Explore all skills by this author →
GitHub

golang-security

Audit Go services for security vulnerabilities using a defense-in-depth checklist.

1|Updated Mar 21, 2026
Search Tags:#injection#go#security review#cryptography#vulnerability prevention#secure logging#filesystem safety
One-click install
npx skills add https://github.com/dashkan/pivox --skill golang-security-dashkan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-security
Source: https://github.com/dashkan/pivox/tree/main/.agents/skills/golang-security
Command: npx skills add https://github.com/dashkan/pivox --skill golang-security-dashkan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, and includes references (resource) components.

What problem does it solve?

It helps you avoid common and high-impact security flaws when writing, reviewing, or auditing Go code by enforcing safe patterns for injection, cryptography, filesystem access, network/web handling, cookies, secrets, memory safety, and secure logging.

Core Features & Use Cases

  • Security review guidance for Go: threat-boundary thinking, STRIDE + DREAD prioritization, and a review-first workflow to trace findings through call paths.
  • Injection & web vulnerability prevention: parameterized queries, safe command execution, XSS-safe HTML templating, SSRF defenses, and safe error handling.
  • Cryptography, cookies, and secrets hardening: vetted primitives (e.g., AES-GCM, Argon2id), TLS guidance, secure cookie attributes, and rules to keep credentials out of source control and logs.
  • Filesystem and network guardrails: path traversal protections (os.Root / safe fallbacks), ZipSlip checks, decompression-bomb mitigation, HTTP timeouts, and non-exposure of pprof.
  • Use case: when building authentication and storage gateway endpoints, apply the skill’s checks so user-controlled inputs cannot turn into SQL injection, command injection, SSRF, path traversal, or credential leaks.

Quick Start

Use the golang-security skill to audit a Go service you’re implementing by requesting a sequential security review of the changed handlers and their data flows for injection, auth, secrets, crypto, filesystem, and logging risks.

Frequently Asked Questions about golang-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent path traversal and ZipSlip vulnerabilities in Go file handling?▼

Prevent path traversal in Go by confining file operations with os.Root and implementing ZipSlip checks during archive extraction to block user-controlled paths from escaping designated directories.

What is the best way to secure Go cookies and prevent credential leaks in web services?▼

Secure Go cookies by enforcing strict attributes and keeping credentials out of source control and logs, utilizing vetted cryptographic primitives like AES-GCM and Argon2id for secret hardening.

How do I audit Go code for injection vulnerabilities during a PR review?▼

Audit Go code for injection by tracing untrusted inputs through call paths, enforcing parameterized queries for SQL, safe command execution, and XSS-safe HTML templating during threat-boundary analysis.

Does this Go security review cover SSRF defenses and HTTP timeout hardening?▼

Yes, this Go security review covers SSRF defenses and HTTP timeout hardening, alongside TLS guidance and ensuring pprof endpoints are not exposed to prevent network-level attacks.

What cryptography rules should I follow when implementing authentication in Golang?▼

Implement Golang authentication by pinning vetted cryptographic algorithms, applying TLS hardening, using safe randomness for tokens, and enforcing secure cookie settings to protect user sessions.

How do I mitigate decompression bombs and ensure structured non-PII logging in Go?▼

Mitigate decompression bombs in Go by applying size limits during extraction, and ensure structured non-PII logging by stripping sensitive credentials from log outputs to maintain privacy.

Related Skills

Explore More Software Engineering Skills→
bricerisingbricerising
7

security

Enforce authentication, authorization, input validation, and secure data handling guardrails.

Community
Advanced
QunnnnQunnnn

go-observability

Standardize Go service logs, metrics, and traces with slog, Prometheus, and OpenTelemetry.

Community
Intermediate
meridianhubmeridianhub
10

skill-security-practices

Automate security scanning with gosec, Trivy, and SBOM generation in CI/CD pipelines.

Official
Advanced
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced