Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Concurrency Skill Security Audit

What the author says it does (original text)

Golang concurrency design — goroutine lifecycle and leak prevention, channels and `select`, channel ownership and direction, `sync.Mutex`/`RWMutex`/`sync.Map`/`sync.Once`/atomics, `errgroup`, `singleflight`, worker pools, and fan-out/fan-in pipelines. Use when writing or reviewing concurrent Go code, when choosing between channels and mutexes, when protecting a shared map or counter, or when a gor

Independent security check

Security risks found

Files checked
5
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The full-project go test command executes repository code

Source references: 2
What we found

The Skill explicitly recommends `go test -race ./...` and permits all `go` subcommands. This compiles and executes initialization logic, TestMain, and tests in every matching package; Go may also download missing modules according to the environment configuration.

Why this matters

In an untrusted or side-effect-heavy repository, tests could modify files, contact services, use local credentials, or consume substantial resources.

This command is an active checklist recommendation, not merely an evaluation example, and the tool declaration permits every `go` subcommand. If the agent runs `go test -race ./...`, it compiles and executes tests, `TestMain`, and relevant initialization code across matching packages, and Go may fetch dependencies according to its environment. Untrusted repository code could therefore run with the agent process's permissions. Users can require prior review of test entry points and restrict network, credentials, and filesystem writes.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
Show 1 other places
SKILL.md:123In the instructionsOpen original file
| `wg.Add` inside goroutine | Call `Add` before `go` — `Wait` may return early otherwise || Forgetting `-race` in CI | Always run `go test -race ./...` || Mutex held across I/O | Keep critical sections short |
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Low risk

pprof diagnostics may bring runtime internals into agent output

Source references: 4
What we found

The Skill provides commands to fetch a goroutine-leak profile from localhost and also recommends stack dumps. Such diagnostics can contain source paths, function names, runtime structure, and other internal context, with no instruction to inspect or redact them first.

Why this matters

For a production process, diagnostic content could enter terminal logs, an AI conversation, or a shared report, broadening access to internal runtime information. The shown URL is localhost only; there is no evidence of transmission to an external site.

What this evidence establishes

The source does provide commands that read goroutine-leak data from a local pprof endpoint and mentions stack dumps; such diagnostics can contain function names and source paths. However, it does not direct the agent to transmit the results or require these commands to run, and the declared Bash allowlist does not include `curl`, so that command should be unavailable in an enforcing host. Whether `go tool pprof` runs and its output enters agent context depends on the task and host, making the risk conditional rather than established.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:139In the instructionsOpen original file
```bashcurl http://localhost:6060/debug/pprof/goroutineleak?debug=2go tool pprof http://localhost:6060/debug/pprof/goroutineleak```
Show 3 other places
SKILL.md:144In the instructionsOpen original file
Keep existing tools:- tests: `go.uber.org/goleak`- runtime count: `runtime.NumGoroutine()`- stack dump: `/debug/pprof/goroutine?debug=2`- race checks: `go test -race ./...`
SKILL.md:146In the instructionsOpen original file
- tests: `go.uber.org/goleak`- runtime count: `runtime.NumGoroutine()`- stack dump: `/debug/pprof/goroutine?debug=2`- race checks: `go test -race ./...`
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

All git subcommands are permitted, beyond what concurrency analysis requires

Source references: 3
What we found

`Bash(git:*)` can cover not only status and diff inspection but also push, forceful reset, clean, or branch deletion. The Skill does not limit access to the read-only commands needed for review and audit.

Why this matters

If the agent misuses this permission, it could alter a remote repository, remove uncommitted files, or rewrite local history. The supplied content does not show that such an operation will occur.

The live tool declaration permits any `git` subcommand, while the Skill's review/audit purpose mainly requires reading status and diffs. If the host grants tools solely from this declaration, the agent could also run repository-changing operations such as push, reset, clean, or branch deletion. The source neither requests those actions nor imposes a read-only restriction. Users can ask for an explicit read-only git allowlist or have the host block mutating git commands.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
Show 2 other places
SKILL.md:28In the instructionsOpen original file
- **Write mode** — implement concurrent code (goroutines, channels, sync primitives, worker pools, pipelines). Follow the sequential instructions below.- **Review mode** — reviewing a PR's concurrent code changes. Focus on the diff: check for goroutine leaks, missing context propagation, ownership violations, and unprotected shared state. Sequential.- **Audit mode** — auditing existing concurrent code across a codebase. Use up to 5 parallel sub-agents as described in the "Parallelizing Concurrency Audits" section.
SKILL.md:29In the instructionsOpen original file
- **Write mode** — implement concurrent code (goroutines, channels, sync primitives, worker pools, pipelines). Follow the sequential instructions below.- **Review mode** — reviewing a PR's concurrent code changes. Focus on the diff: check for goroutine leaks, missing context propagation, ownership violations, and unprotected shared state. Sequential.- **Audit mode** — auditing existing concurrent code across a codebase. Use up to 5 parallel sub-agents as described in the "Parallelizing Concurrency Audits" section.
Medium risk

Large audits expand code access to five sub-agents

Source references: 3
What we found

The Skill directs large-codebase audits to fan out five sub-agents and requests Agent permission. Each agent searches a different concurrency category, so additional AI execution contexts may access the codebase.

Why this matters

For repositories containing confidential source or governed by access policies, this increases the code exposure surface, model usage, and opportunities for agent mistakes. There is no evidence that the sub-agents send code to an external recipient.

For audit mode on a “large codebase,” this is an explicit live instruction to distribute five repository-wide search categories among up to five sub-agents, and the Skill requests the `Agent` capability. If used, more independent model contexts can read code and findings, expanding code exposure and automated decision surface; no directory, sensitive-file, or visibility boundary is stated. This does not prove data leaves the service. Users can restrict execution to one agent, approved directories, or exclude sensitive code from sub-agent context.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
Show 2 other places
SKILL.md:24In the instructionsOpen original file
**Orchestration mode:** Fan out the five sub-agents described in the "Parallelizing Concurrency Audits" section for auditing concurrent code across a large codebase, and consolidate their findings into one report. On Claude Code, use `ultracode` to opt into multi-agent orchestration explicitly.
SKILL.md:104In the instructionsOpen original file
When auditing concurrency across a large codebase, use up to 5 parallel sub-agents:1. Find all goroutine spawns (`go func`, `go method`) and verify shutdown mechanisms2. Search for mutable globals and shared state without synchronization3. Audit channel usage — ownership, direction, closure, buffer sizes4. Find `time.After` in loops, missing `ctx.Done()` in select, unbounded spawning5. Check mutex usage, `sync.Map`, atomics, and thread-safety documentation
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill covers writing concurrent Go code, reviewing PR changes, and auditing a codebase; writing and review are sequential, while large audits invoke multiple sub-agents.

View source
SKILL.md:28In the instructionsOpen original file
- **Write mode** — implement concurrent code (goroutines, channels, sync primitives, worker pools, pipelines). Follow the sequential instructions below.- **Review mode** — reviewing a PR's concurrent code changes. Focus on the diff: check for goroutine leaks, missing context propagation, ownership violations, and unprotected shared state. Sequential.- **Audit mode** — auditing existing concurrent code across a codebase. Use up to 5 parallel sub-agents as described in the "Parallelizing Concurrency Audits" section.

It declares no installation steps, but requests file read/edit/write access, arbitrary go, golangci-lint, and git subcommands, and agent spawning.

View source
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:

The Skill recommends race detection, goroutine-leak tests, and a local pprof endpoint for diagnostics.

View source
SKILL.md:139In the instructionsOpen original file
```bashcurl http://localhost:6060/debug/pprof/goroutineleak?debug=2go tool pprof http://localhost:6060/debug/pprof/goroutineleak```Keep existing tools:- tests: `go.uber.org/goleak`- runtime count: `runtime.NumGoroutine()`- stack dump: `/debug/pprof/goroutine?debug=2`- race checks: `go test -race ./...`
Start here · InstructionsSKILL.md
golang-concurrency
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/channels-and-select.mdFull text included
  • references/pipelines.mdFull text included
  • references/sync-primitives.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/channels-and-select.mdSupporting file
  • references/pipelines.mdSupporting file
  • references/sync-primitives.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "⚡"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:140In the instructionsOpen original file
```bashcurl http://localhost:6060/debug/pprof/goroutineleak?debug=2go tool pprof http://localhost:6060/debug/pprof/goroutineleak
SKILL.md:141In the instructionsOpen original file
curl http://localhost:6060/debug/pprof/goroutineleak?debug=2go tool pprof http://localhost:6060/debug/pprof/goroutineleak```
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
SKILL.md:139In the instructionsOpen original file
```bashcurl http://localhost:6060/debug/pprof/goroutineleak?debug=2
Change files
references/sync-primitives.md:155In the instructionsOpen original file
    buf.Write(data)    // ... transform ...
Read files
references/sync-primitives.md:181In the instructionsOpen original file
        var err error        c.conn, err = sql.Open("postgres", dsn)        if err != nil {
Lines read
1,304
File checksum (to compare versions)
c5f267aa1262ae5c22d58f5e1a39daadddb2ffbe30fb0ef6f9375e1a15dd2d6f