golang-security

Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging. Apply when writing, reviewing, or auditing Go code for security, or when working on any risky code involving crypto, I/O, secrets management, user input handling, or authentication. Includes configuration of security tools.

1,714stars111forksUpdated 5/18/2026

Security Code Review #security #vulnerability-prevention #golang #cryptography #secure-coding #code-review

Security Assessment

Critical Risk(25/100)

Detected risks:

Remote Code Execution([references/injection.md] Exec()

Secret Exposure([references/secrets.md] AWS_ACCESS_KEY, [references/secrets.md] PASSWORD =, [references/secrets.md] SECRET =)

Sensitive File Access([references/secrets.md] .env, [references/filesystem.md] /etc/passwd)

Security Score25/100

About golang-security

The golang-security skill provides comprehensive guidance on securing Go (Golang) applications, focusing on best practices and vulnerability prevention. It addresses critical security areas such as injection attacks (SQL, command, XSS), cryptography, filesystem safety, network security, cookie management, secrets handling, memory safety, and logging. The skill is designed to help developers write, review, or audit Go code with a security-first mindset, emphasizing the principle of defense in depth. By guiding users through threat modeling, input validation, and secure defaults, it reduces the likelihood of vulnerabilities and ensures that risky code areas are properly assessed.

FAQ

How do I use golang-security when reviewing a pull request?

You can use the Review mode, which starts from the changed files and traces call sites and data flows into adjacent code. This helps identify vulnerabilities that may not appear directly in the diff but could be triggered by it.

Is golang-security compatible with my Go project?

Yes, it is designed for projects using Golang and is compatible with AI coding agents like Claude Code. It requires Go and the govulncheck tool to perform certain security checks.

What limitations or prerequisites should I be aware of?

The skill assumes access to Go development tools and optionally govulncheck for vulnerability scanning. It is intended for users familiar with Go coding practices, security auditing, and handling sensitive operations.

Can I use golang-security to write new secure code?

Yes, the Coding mode guides users in writing new code or fixing vulnerabilities. It can also run background agents to search for common vulnerability patterns while implementing features.