Skip to content
Report library
Purpose / Development

Golang Code Style Skill Security Audit

What the author says it does (original text)

Golang code style conventions — line length and breaking, variable declarations, control flow clarity, when comments help vs hurt. Use when writing or reviewing Go code, asking about style or clarity, or establishing project coding standards. Not for naming conventions (→ See `samber/cc-skills-golang@golang-naming` skill), linter configuration (→ See `samber/cc-skills-golang@golang-lint` skill), o

Independent security check

Security risks found

Files checked
3
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
Medium risk

“Style” rules can change program semantics and public APIs

Source references: 3
What we found

The Skill goes beyond formatting: it requires collections never to be nil, recommends options structs above four parameters, and calls for aggressive unexporting. Nil and empty collections can carry different contract meanings, while signatures and export status define what callers can use.

Why this matters

Applying these rules to an existing project could change JSON output, break logic that relies on nil, or make downstream code fail to compile. Unexporting can also be a breaking API change.

These are not purely formatting rules. If mechanically applied to existing code, “never nil” collections can change JSON or caller-visible nil/empty semantics; an options struct changes function signatures; unexporting names can break external callers. The risk arises when these rules are used to modify an existing API. A user can require report-only review and prohibit collection-semantic, exported-name, or signature changes without itemized approval.

SKILL.md:66In the instructionsOpen original file
Slices and maps MUST be initialized explicitly, never nil. Nil maps panic on write; nil slices serialize to `null` in JSON (vs `[]` for empty slices), surprising API consumers.
Show 2 other places
SKILL.md:174In the instructionsOpen original file
- Functions SHOULD be **short and focused** — one function, one job.- Functions SHOULD have **≤4 parameters**. Beyond that, use an options struct (see `samber/cc-skills-golang@golang-design-patterns` skill).- **Parameter order**: `context.Context` first, then inputs, then output destinations.- Naked returns help in very short functions (1-3 lines) where return values are obvious, but become confusing when readers must scroll to find what's returned — name returns explicitly in longer functions.
SKILL.md:204In the instructionsOpen original file
- **Dot imports** pollute the namespace and make it impossible to tell where a name comes from — never use in library code- **Unexport aggressively** — you can always export later; unexporting is a breaking change. → See `samber/cc-skills-golang@golang-gopls` skill to unexport safely — its rename updates every call site atomically and refuses the change when lowercasing a method would break interface satisfaction, a breakage grep/sed silently ships.
Medium risk

A style recommendation can introduce a new third-party Go dependency

Source references: 2
What we found

The Skill directly recommends `github.com/samber/lo` for filtering, grouping, and chunking despite presenting itself as code-style guidance. Following it can add an external module rather than merely improve readability.

Why this matters

The project’s dependency manifest, build downloads, and supply-chain exposure can change, with possible version, licensing, and maintenance costs.

The Skill directly recommends an external module for filter/group-by/chunk operations. If an agent follows that recommendation in code, the project may gain a download, build, and supply-chain dependency beyond a readability-only change. However, the install list is empty and no command here automatically installs the module, so the risk is conditional on adopting the suggestion and updating dependencies. Users can require standard-library-only code or separate approval and version review for every new module.

SKILL.md:220In the instructionsOpen original file
- **"A little copying is better than a little dependency"**- **Use `slices` and `maps` standard packages**; for filter/group-by/chunk, use `github.com/samber/lo`- **"Reflection is never clear"** — avoid `reflect` unless necessary- **Don't abstract prematurely** — extract when the pattern is stable
Show 1 other places
SKILL.md:16In the instructionsOpen original file
        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

A style review can automatically expand to five agents

Source references: 3
What we found

The Skill grants the Agent tool and directs reviews of large repositories to launch up to five sub-agents. A user requesting a style review may not expect the increased agent count or repository exposure.

Why this matters

This can increase execution cost and cause more agents to process repository content. In a host with weak agent isolation, the affected permission surface may also expand.

For style reviews of a “large codebase,” the Skill directs fan-out and requests Agent tool access, potentially increasing both the number of actors reading code and the review scope. The text calls for explicit `ultracode` opt-in on Claude Code, but does not state an equally clear confirmation condition for other compatible harnesses. Users can require one agent, name the permitted directories, and require confirmation before expansion.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Show 2 other places
SKILL.md:22In the instructionsOpen original file
**Orchestration mode:** Fan out the sub-agents described in the "Parallelizing Code Style Reviews" section, each covering an independent style concern, when reviewing code style across a large codebase, and merge their findings. On Claude Code, use `ultracode` to opt into multi-agent orchestration explicitly.
SKILL.md:228In the instructionsOpen original file
When reviewing code style across a large codebase, use up to 5 parallel sub-agents, each targeting an independent style concern (e.g. control flow, function design, variable declarations, string handling, code organization).
Medium risk

A style Skill receives unrestricted git-subcommand execution

Source references: 2
What we found

The allowed tools include `Bash(git:*)`, while the visible workflow only describes code-style review and does not identify required git operations. The wildcard can cover history-writing, branch-changing, or remote git subcommands, which is broader than a style check needs.

Why this matters

If misused, a command could alter the worktree, branches, or commit history. In environments with configured remotes and credentials, some git commands could also affect a remote repository.

The manifest requests `Bash(git:*)` without limiting it to read-only subcommands, while the visible style workflow specifies no required git operation. The permission does not prove that history-changing, branch-switching, or remote commands will run; exposure depends on how the harness enforces the manifest and what the agent chooses. Users can deny git access or allow only read-only commands such as `git diff`, `status`, and `show`.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Show 1 other places
SKILL.md:28In the instructionsOpen original file
Style rules that require human judgment — linters handle formatting, this skill handles clarity. For naming see `samber/cc-skills-golang@golang-naming` skill; for design patterns see `samber/cc-skills-golang@golang-design-patterns` skill; for struct/interface design see `samber/cc-skills-golang@golang-structs-interfaces` skill.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

The Skill explicitly overrides user-requested code form

Source references: 2
What we found

It says its rule must be followed even when the prompt expressly asks for single-line code, and directs the agent to add code comments when ignoring a rule. This lets the Skill’s preferences supersede project-specific user decisions.

Why this matters

The result may violate an explicit formatting or compatibility requirement and, when writes are allowed, may introduce code changes the user did not request.

The Skill expressly requires its line-breaking rule even when the user asks for single-line code, and it directs the agent to add a code comment when a rule is ignored. It can therefore override an explicit decision about code form and create extra edits. This does not show it would override functional requirements, but users can require project rules or task-specific instructions to take precedence and forbid automatic exception comments.

SKILL.md:32In the instructionsOpen original file
When ignoring a rule, add a comment to the code.
Show 1 other places
SKILL.md:36In the instructionsOpen original file
No rigid line limit, but lines beyond ~120 characters MUST be broken. Break at **semantic boundaries**, not arbitrary column counts. Function calls with 4+ arguments MUST use one argument per line — even when the prompt asks for single-line code:
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill is intended for writing or reviewing Go code and applies judgment-based “clarity” rules beyond formatting.

View source
SKILL.md:3In the instructionsOpen original file
name: golang-code-styledescription: "Golang code style conventions — line length and breaking, variable declarations, control flow clarity, when comments help vs hurt. Use when writing or reviewing Go code, asking about style or clarity, or establishing project coding standards. Not for naming conventions (→ See `samber/cc-skills-golang@golang-naming` skill), linter configuration (→ See `samber/cc-skills-golang@golang-lint` skill), or doc comments (→ See `samber/cc-skills-golang@golang-documentation` skill)."user-invocable: true
SKILL.md:28In the instructionsOpen original file
Style rules that require human judgment — linters handle formatting, this skill handles clarity. For naming see `samber/cc-skills-golang@golang-naming` skill; for design patterns see `samber/cc-skills-golang@golang-design-patterns` skill; for struct/interface design see `samber/cc-skills-golang@golang-structs-interfaces` skill.

The metadata declares no installation steps, but requires Go and permits file writes, Go and golangci-lint commands, unrestricted git subcommands, and agents.

View source
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:

The Skill makes several rules mandatory or strongly preferred even though they can affect runtime semantics or public APIs, including non-nil collections, parameter counts, and unexporting names.

View source
SKILL.md:66In the instructionsOpen original file
Slices and maps MUST be initialized explicitly, never nil. Nil maps panic on write; nil slices serialize to `null` in JSON (vs `[]` for empty slices), surprising API consumers.
SKILL.md:173In the instructionsOpen original file
- Functions SHOULD be **short and focused** — one function, one job.- Functions SHOULD have **≤4 parameters**. Beyond that, use an options struct (see `samber/cc-skills-golang@golang-design-patterns` skill).- **Parameter order**: `context.Context` first, then inputs, then output destinations.- Naked returns help in very short functions (1-3 lines) where return values are obvious, but become confusing when readers must scroll to find what's returned — name returns explicitly in longer functions.
SKILL.md:204In the instructionsOpen original file
- **Dot imports** pollute the namespace and make it impossible to tell where a name comes from — never use in library code- **Unexport aggressively** — you can always export later; unexporting is a breaking change. → See `samber/cc-skills-golang@golang-gopls` skill to unexport safely — its rename updates every call site atomically and refuses the change when lowercasing a method would break interface satisfaction, a breakage grep/sed silently ships.

For large-codebase reviews, the Skill directs the agent to split the review among parallel sub-agents, permitting up to five.

View source
SKILL.md:22In the instructionsOpen original file
**Orchestration mode:** Fan out the sub-agents described in the "Parallelizing Code Style Reviews" section, each covering an independent style concern, when reviewing code style across a large codebase, and merge their findings. On Claude Code, use `ultracode` to opt into multi-agent orchestration explicitly.
SKILL.md:226In the instructionsOpen original file
## Parallelizing Code Style ReviewsWhen reviewing code style across a large codebase, use up to 5 parallel sub-agents, each targeting an independent style concern (e.g. control flow, function design, variable declarations, string handling, code organization).
Start here · InstructionsSKILL.md
golang-code-style
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 4 more sections are available in the original file.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/details.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/details.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🎨"    homepage: https://github.com/samber/cc-skills-golang    requires:
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Read files
evals/evals.json:178In the instructionsOpen original file
    "description": "Helper functions called only within the same package stay unexported; exporting is a commitment",    "prompt": "Write a Go file `parser.go` in package `config`. Include: an exported ParseConfig function that reads a file path and returns a *Config struct; an exported ValidateConfig function that checks required fields; a helper function that tokenizes a raw config string (used only by ParseConfig); a helper function that resolves environment variable references in values (used by ParseConfig and ValidateConfig); a helper function that formats a field path for error messages (used only in error messages inside ValidateConfig). Make all functions exported for potential future reuse from other packages.",    "trap": "Model follows the prompt's instruction to export all functions, leaking tokenizer, env resolver, and error formatter as public API — any future change to them becomes a breaking change",
Lines read
889
File checksum (to compare versions)
75485360ab86c223a14804b9627e71997a9cb5b96beb0fc83c107fce6a1d1ecf