skills.rest
titaneric
titanericCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

golang-security

Audit and write Go code against injection, cryptography, filesystem, and web security vulnerabilities.

1|Updated May 25, 2020
Search Tags:#code review#vulnerability#injection#security audit#go#cryptography#govulncheck
One-click install
npx skills add https://github.com/titaneric/dotfiles --skill golang-security-titaneric
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-security
Source: https://github.com/titaneric/dotfiles/tree/main/dot_agents/skills/golang-security
Command: npx skills add https://github.com/titaneric/dotfiles --skill golang-security-titaneric

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, and includes references (resource) components.

What problem does it solve? Go codebases often ship with preventable vulnerabilities like SQL injection, weak cryptography, path traversal, and leaked secrets. This Skill gives an AI coding agent a structured security methodology to review, audit, and write Go code that resists these attack classes. ## Core Features & Use Cases - Three operating modes: Review mode for PR security checks, Audit mode that fans out five parallel sub-agents across vulnerability domains (injection, crypto, web, auth, concurrency) with DREAD severity scoring, and Coding mode for writing secure new code. - Deep reference library: Detailed guides with bad/good Go code examples covering cryptography, injection, filesystem safety, cookies, logging, secrets management, threat modeling (STRIDE/DREAD), and security architecture patterns like Zero Trust and mTLS. - Tooling integration: Guidance for gosec, govulncheck, race detector, and fuzz testing to verify findings. - Use Case: Ask the agent to audit a Go microservice before release; it scans for hardcoded credentials, unsafe SQL concatenation, missing TLS configuration, and race conditions, then reports findings ranked by severity with concrete fixes. ## Quick Start Ask the agent to perform a security audit of your Go project using the golang-security skill and report findings by severity.

Frequently Asked Questions about golang-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Go codebase for security vulnerabilities?▼

Run a full-codebase audit that fans out parallel checks across five domains: injection patterns, cryptography and secrets, web security headers, authentication and authorization, and concurrency safety. Findings are scored with DREAD and reported by severity from Critical to Low.

How to prevent SQL injection in Go database queries?▼

Use parameterized queries with placeholders ($1 for pgx, ? for MySQL) instead of string concatenation. For dynamic IN clauses, generate numbered placeholders; for dynamic column names or ORDER BY, validate identifiers against an explicit allowlist.

What password hashing algorithm should Go applications use?▼

Use Argon2id as the preferred choice since it is memory-hard and resists GPU attacks, with bcrypt as a simpler alternative. Never use MD5, SHA1, or plain SHA-256 for passwords because fast hashes enable brute-force attacks.

Does Go 1.24 help prevent path traversal vulnerabilities?▼

Yes, Go 1.24 introduces os.Root, which confines file operations to a root directory at the OS level and rejects symlinks escaping it. For earlier versions, combine filepath.IsLocal with filepath.Rel and separator-aware checks instead of relying on filepath.Clean plus HasPrefix.

Why is math/rand unsafe for generating session tokens in Go?▼

math/rand is a deterministic PRNG whose output becomes predictable once the seed or enough output is observed, even if seeded from crypto/rand. Security-critical randomness like tokens and keys must come directly from crypto/rand.

What tools verify Go code security beyond manual review?▼

Use gosec for static security analysis, govulncheck to detect known CVEs in dependencies, go test -race to catch data races, and Go's built-in fuzz testing to probe input handling. These complement manual review of trust boundaries and data flows.

Related Skills

Explore More Software Engineering Skills→
JylhisJylhis
1

golang-dependency-management

Audit Go module dependencies with govulncheck and manage updates.

Community
Intermediate
TencentCloudBaseTencentCloudBase
1.1k

codebase-audit

Audit a codebase, file GitHub issues, and fix findings in isolated git worktrees with PRs.

Official
Advanced
eduardo-sleduardo-sl
64

go-dependency-audit

Audit Go module dependencies for outdated packages and known vulnerabilities.

Community
Intermediate
githubgithub
38.5k

integrate-context-matic

Integrates third-party APIs using the context-matic MCP server for SDK discovery and guidance.

Official
Intermediate