skills.rest
vanstinator
vanstinatorCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

golang-security

Audit Go applications for security vulnerabilities using DREAD prioritization.

Updated May 28, 2026
Search Tags:#secure coding#security audit#go#vulnerability prevention#crypto#authz#injection mitigation
One-click install
npx skills add https://github.com/vanstinator/semantic-search --skill golang-security-vanstinator
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-security
Source: https://github.com/vanstinator/semantic-search/tree/main/.agents/skills/golang-security
Command: npx skills add https://github.com/vanstinator/semantic-search --skill golang-security-vanstinator

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, and includes references (resource) components.

What problem does it solve?

It helps you detect and prevent common security vulnerabilities in Go code before they reach production, reducing the chance of RCE, data leaks, auth bypasses, and unsafe cryptography.

Core Features & Use Cases

  • Security Audit & Triage: Performs domain-focused security scanning (injection, crypto/secrets, web security, authn/authz, concurrency/dependencies) and reports prioritized findings using DREAD severity scoring.
  • Threat-Model-Guided Reviews: Uses trust-boundary thinking (STRIDE) and end-to-end data-flow tracing so issues are assessed in context rather than as isolated snippets.
  • Secure-by-Default Coding & Checklists: Provides Go-specific guidance on safe defaults (parameterized SQL, exec.Command usage, html/template escaping, os.Root confinement, secure cookies, TLS hardening, timeouts, and safer error/log handling) plus verification/testing recommendations like govulncheck and go test -race.

Quick Start

Use this skill to audit or write secure Go code for the feature you are implementing, then explicitly follow Coding mode steps for validation, secure primitives, and review checklists.

Frequently Asked Questions about golang-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security audit on Go code to prevent vulnerabilities?▼

Perform a Go security audit by scanning injection points, crypto usage, and web handlers, then prioritizing findings using DREAD severity scoring to prevent exploitable vulnerabilities before production.

How does STRIDE threat modeling apply to Go application security reviews?▼

STRIDE threat modeling applies to Go security by mapping trust boundaries and tracing end-to-end data flows, ensuring code issues are assessed in context rather than as isolated snippets during PR reviews.

What is the best way to prevent SQL injection and command injection in Go?▼

Prevent SQL injection and command injection in Go by using parameterized database queries and invoking exec.Command without a shell wrapper to avoid unsafe input interpretation.

Can I use govulncheck to scan dependencies during a Go security review?▼

Yes, you can use govulncheck to scan Go dependencies for known vulnerabilities, forming a critical part of the operational requirements for secure coding validation and dependency risk assessment.

Do I need to manually escape HTML templates in Go to prevent XSS?▼

You do not need to manually escape HTML templates in Go; html/template provides automatic contextual auto-escaping to prevent XSS vulnerabilities by default when rendering dynamic web content.

How to handle filesystem security and prevent path traversal in Go?▼

Handle Go filesystem security by applying os.Root confinement to restrict directory access, preventing path traversal vulnerabilities when applications handle risky file I/O operations.

Related Skills

Explore More Software Engineering Skills→
tamago0224tamago0224

golang-security

Identify security vulnerabilities in Go code using govulncheck and static analysis.

Community
Advanced
HemantSudarshanHemantSudarshan

backend-security-coder

Hardens backend applications against common vulnerabilities through input validation and secure coding.

Community
Advanced
harnessharness
80

configure-repo-scan

Insert code scanning steps into existing Harness pipeline YAML.

Official
Intermediate
kaustubhhiwarekaustubhhiware

security-reviewer

Audit code and cloud configurations for security vulnerabilities.

Community
Advanced