Skip to content
Report library
Purpose / Data analysis

Golang Data Structures Skill Security Audit

What the author says it does (original text)

Golang data structures — slices (internals, capacity growth, preallocation, slices package), maps (internals, hash buckets, maps package), arrays, container/list/heap/ring, strings.Builder vs bytes.Buffer, generic collections, pointers (unsafe.Pointer, weak.Pointer), and copy semantics. Use when choosing or optimizing Go data structures, implementing generic containers, using container/ packages,

Independent security check

Security risks found

Files checked
7
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The Skill can guide agents to generate unsafe memory access that bypasses Go's type system

Source references: 6
What we found

The reference explicitly teaches `unsafe.Pointer` and gives examples of type reinterpretation, address arithmetic, and syscall arguments. Such code bypasses the type system, and the examples cannot ensure that an agent's application has valid input lengths, alignment, object lifetimes, or target-platform layout.

Why this matters

If an agent applies these patterns to data or layouts that do not satisfy their prerequisites, the resulting program may crash, read incorrect data, or corrupt memory. With externally supplied input, this can become a denial-of-service or data-integrity risk.

Legitimate use of this code

The reference does contain unsafe.Pointer examples, but low-level pointer handling is an expressly stated topic, not an instruction to execute such code unconditionally. The surrounding text limits use to Go-spec patterns, labels other patterns undefined, and recommends modern APIs that avoid uintptr arithmetic; the shown arithmetic is explicitly constrained to one expression. These lines show no concrete bad bounds, alignment, or lifetime handling, so they do not support the claimed unsafe implementation risk beyond the inherent nature of the topic. Users can still prohibit unsafe unless a reviewed FFI or layout need exists.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/pointers.md:45In the instructionsOpen original file
## `unsafe.Pointer``unsafe.Pointer` bypasses Go's type system for FFI and low-level memory manipulation. Only the 6 patterns from the Go spec are safe; any other pattern is undefined behavior.### The 6 Valid Patterns (from the Go spec)These are the ONLY safe ways to use `unsafe.Pointer`. Any other pattern is undefined behavior.
Show 5 other places
references/pointers.md:53In the instructionsOpen original file
**Pattern 1: Convert `*T` to `*U` via `unsafe.Pointer`**```go// Reinterpret a float64 as its raw bitsf := 1.5bits := *(*uint64)(unsafe.Pointer(&f))```
references/pointers.md:61In the instructionsOpen original file
**Pattern 2: Convert `unsafe.Pointer` to `uintptr` and back (same expression)**```go// Pointer arithmetic — MUST be a single expressionp := unsafe.Pointer(uintptr(unsafe.Pointer(&s.field)) + offset)```
references/pointers.md:74In the instructionsOpen original file
**Pattern 4: `syscall.Syscall` arguments**```gosyscall.Syscall(SYS_READ, fd, uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf)))```
references/pointers.md:49In the instructionsOpen original file
### The 6 Valid Patterns (from the Go spec)These are the ONLY safe ways to use `unsafe.Pointer`. Any other pattern is undefined behavior.
references/pointers.md:92In the instructionsOpen original file
### Modern Alternatives (prefer these)| Function | Since | Purpose || --- | --- | --- || `unsafe.Add(ptr, len)` | Go 1.17 | Pointer arithmetic without `uintptr` conversion || `unsafe.Slice(ptr, len)` | Go 1.17 | Create slice from pointer + length || `unsafe.String(ptr, len)` | Go 1.20 | Create string from pointer + length || `unsafe.SliceData(s)` | Go 1.17 | Get pointer to slice's backing array || `unsafe.StringData(s)` | Go 1.20 | Get pointer to string's backing array |These are safer than manual `uintptr` arithmetic because they keep values as pointers (visible to GC) throughout.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Unrestricted git and sub-agent permissions exceed the needs of data-structure guidance

Source references: 3
What we found

The manifest permits `Bash(git:*)` without limiting it to read-only subcommands, alongside `Agent`, file writing, and editing. The Skill body mainly provides Go data-structure guidance and does not explain a need for full git capabilities such as pushing, rewriting history, or deleting branches.

Why this matters

If the host enforces this grant and the agent is misdirected or misjudges a task, it could alter repository history, switch or delete branches, or send content to a configured remote. Sub-agents also expand the execution surface exposed to project material. The permission declaration does not show that this occurred.

The manifest grants Edit, Write, Agent, and Bash(git:*) without limiting Git subcommands, while the stated purpose is guidance on Go data structures. This does not execute Git by itself, but when the Skill is invoked and its tool list is honored, it could permit file changes, sub-agents, or high-impact Git operations such as push or reset without a stated need. A user can ask the author to restrict Git to read-only commands, remove Agent, and require explicit approval for writes.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__* mcp__context7__resolve-library-id mcp__context7__query-docspaths:  - "**/*.go"---
Show 2 other places
SKILL.md:22In the instructionsOpen original file
**Persona:** You are a Go engineer who understands data structure internals. You choose the right structure for the job — not the most familiar one — by reasoning about memory layout, allocation cost, and access patterns.
SKILL.md:24In the instructionsOpen original file
# Go Data StructuresBuilt-in and standard library data structures: internals, correct usage, and selection guidance.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is guidance for selecting and implementing Go data structures, with examples covering slices, maps, containers, generics, and pointers; its manifest declares no installation steps.

View source
SKILL.md:2In the instructionsOpen original file
---name: golang-data-structuresdescription: "Golang data structures — slices (internals, capacity growth, preallocation, slices package), maps (internals, hash buckets, maps package), arrays, container/list/heap/ring, strings.Builder vs bytes.Buffer, generic collections, pointers (unsafe.Pointer, weak.Pointer), and copy semantics. Use when choosing or optimizing Go data structures, implementing generic containers, using container/ packages, unsafe or weak pointers, or questioning slice/map internals. Not for applying optimization patterns once profiling has identified a bottleneck (→ See `samber/cc-skills-golang@golang-performance` skill)."user-invocable: true
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__* mcp__context7__resolve-library-id mcp__context7__query-docs

It requests file reading, editing and writing, plus Go, git, analysis-tool, language-server, and sub-agent capabilities; this is a capability declaration, not evidence that any command ran.

View source
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__* mcp__context7__resolve-library-id mcp__context7__query-docspaths:  - "**/*.go"---

The Skill recommends a Go package-information tool first and permits Context7 as a fallback for documentation not otherwise indexed; what reaches that service depends on the queries the agent actually sends.

View source
SKILL.md:165In the instructionsOpen original file
When using third-party libraries, refer to their official documentation and code examples for current API signatures.- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts.- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).- Context7 remains a fallback for docs not indexed on pkg.go.dev.

The tasks and assertions in `evals/evals.json` are evaluation cases rather than live operational instructions in the Skill body; for example, one test asks for generated code using unsafe pointer arithmetic.

View source
evals/evals.json:37In the instructionsOpen original file
    "id": 4,    "name": "unsafe.Add-modern",    "description": "Read packed binary header using modern unsafe.Add (Go 1.17+)",    "task": "Write a function `ReadFields(data []byte) (magic uint32, version uint16, length uint32)` in package `proto` that reads a packed binary header. The header layout is: 4 bytes magic, 2 bytes version, 2 bytes padding, 4 bytes length. Use unsafe pointer arithmetic to access each field at its offset. Target Go 1.17+.",    "assertions": [      { "id": "4.1", "text": "Uses `unsafe.Add` for pointer arithmetic", "trap": "Without skill, model uses old-style uintptr(base) + offset casting" },      { "id": "4.2", "text": "No intermediate `uintptr` variable", "trap": "Model might split pointer arithmetic across statements" },      { "id": "4.3", "text": "Bounds check before unsafe access", "trap": "none — baseline safety" }    ]
Start here · InstructionsSKILL.md
golang-data-structures
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 5 more sections are available in the original file.

File reference map

References: 5
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records7 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/containers.mdFull text included
  • references/generics.mdFull text included
  • references/map-internals.mdFull text included
  • references/pointers.mdFull text included
  • references/slice-internals.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/containers.mdSupporting file
  • references/generics.mdSupporting file
  • references/map-internals.mdSupporting file
  • references/pointers.mdSupporting file
  • references/slice-internals.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🗃"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:192In the instructionsOpen original file
- [Go Data Structures (Russ Cox)](https://research.swtch.com/godata)- [The Go Memory Model](https://go.dev/ref/mem)
SKILL.md:193In the instructionsOpen original file
- [Go Data Structures (Russ Cox)](https://research.swtch.com/godata)- [The Go Memory Model](https://go.dev/ref/mem)- [Effective Go](https://go.dev/doc/effective_go)
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__* mcp__context7__resolve-library-id mcp__context7__query-docspaths:
Lines read
842
File checksum (to compare versions)
3bf08095cf582239195105fc68b75c02cd9851b0f298633fcd56947e46f8ceb7