Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Database Skill Security Audit

What the author says it does (original text)

Comprehensive guide for Go database access — parameterized queries, struct scanning, NULLable columns, transactions, isolation levels, SELECT FOR UPDATE, connection pool, batch processing, context propagation, and migration tooling. Use when writing, reviewing, or debugging Golang code that interacts with PostgreSQL, MariaDB, MySQL, or SQLite; for database testing; or for questions about database/

Independent security check

Security risks found

Files checked
6
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Broad `EXPLAIN ANALYZE` guidance can execute write statements

Source references: 2
What we found

The Skill directs the agent to use `EXPLAIN ANALYZE` before optimization without limiting it to read-only SELECT statements. In PostgreSQL, ANALYZE actually runs the analyzed statement rather than merely displaying its plan.

Why this matters

Using it with INSERT, UPDATE, DELETE, or another side-effecting statement can modify the connected database and may cause locks, trigger effects, or heavy load.

This is an active performance instruction to use `EXPLAIN ANALYZE`, without limiting it to read-only queries. PostgreSQL actually runs the analyzed statement, so applying it to UPDATE, DELETE, or INSERT could modify user data. The document says performance changes need human review, but does not explicitly prohibit executing this diagnostic command. Users can ask that it be restricted to SELECT statements or replaced with non-executing `EXPLAIN`.

references/performance.md:220In the instructionsOpen original file
- **`EXPLAIN ANALYZE`** before optimizing — measure, don't guess- **List columns explicitly** — avoid `SELECT *`, it fetches unnecessary data and breaks struct scanning when schema changes
Show 1 other places
references/performance.md:225In the instructionsOpen original file
- **Avoid N+1 queries** — use `JOIN` or batch `WHERE id IN (...)` instead of querying in a loop- **Suggest improvements, never execute them** — performance changes (indexes, query rewrites, configuration) need human review in context of production data and workload patterns
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Test template can connect to and migrate an unvalidated database

Source references: 3
What we found

The template trusts `TEST_DATABASE_URL` directly and suggests running migrations before per-test transactions begin. Although the document says never to test production, the example does not validate the database name, host, or an explicit test marker.

Why this matters

If the variable mistakenly targets a shared, staging, or production database, test initialization can make lasting schema or data changes. Per-test rollback cannot undo migrations already run during suite initialization.

What this evidence establishes

The example directly connects using `TEST_DATABASE_URL`, and its migration comment appears before per-test transaction isolation, so a misconfigured value could target the wrong database. However, “Run migrations” is only a comment, not executable migration code, and the document explicitly forbids production testing. The source does not establish automatic migration execution, though the template lacks an enforced test-environment check. Users can restrict credentials and require validation of a dedicated test-database marker before connecting.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/testing.md:131In the instructionsOpen original file
func (s *UserRepoSuite) SetupSuite() {    dsn := os.Getenv("TEST_DATABASE_URL") // e.g., postgres://test:test@localhost:5432/testdb?sslmode=disable    db, err := sqlx.Connect("postgres", dsn)    s.Require().NoError(err)    s.db = db    // Run migrations here if needed}
Show 2 other places
references/testing.md:143In the instructionsOpen original file
func (s *UserRepoSuite) SetupTest() {    tx, err := s.db.Beginx()    s.Require().NoError(err)    s.tx = tx}func (s *UserRepoSuite) TearDownTest() {    s.tx.Rollback() // rolls back all changes — each test starts clean}
references/testing.md:219In the instructionsOpen original file
- Integration tests SHOULD use testcontainers-go for reproducible database environments in CI.- NEVER test against production databases.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Declared git permission covers every subcommand beyond the Skill's database-guidance needs

Source references: 3
What we found

`Bash(git:*)` is not restricted to read-only inspection, while the stated purpose is generating and reviewing Go database code. In hosts that enforce this syntax, the scope can admit git operations with remote or persistent repository effects even though the body does not request them.

Why this matters

If repository content or a later prompt misdirects the agent, repository configuration, references, or remote state could be changed. The actual impact depends on the repository and credentials exposed by the host.

The tool list grants `git:*` rather than limiting access to read-only commands such as status or diff. In a harness that enforces this syntax, that could permit pushes, commits, branch deletion, or other local and remote repository effects. The body asks only for searching existing code patterns and does not justify unrestricted Git commands, so the capability exceeds the stated task. Permission alone does not show that any command ran. Users can require an allowlist of necessary read-only Git operations and block remote or destructive subcommands.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
Show 2 other places
SKILL.md:3In the instructionsOpen original file
name: golang-databasedescription: "Comprehensive guide for Go database access — parameterized queries, struct scanning, NULLable columns, transactions, isolation levels, SELECT FOR UPDATE, connection pool, batch processing, context propagation, and migration tooling. Use when writing, reviewing, or debugging Golang code that interacts with PostgreSQL, MariaDB, MySQL, or SQLite; for database testing; or for questions about database/sql, sqlx, or pgx. Does NOT generate database schemas or migration SQL."user-invocable: true
SKILL.md:26In the instructionsOpen original file
- **Write mode** — generating new repository functions, query helpers, or transaction wrappers: follow the skill's sequential instructions; launch a background agent to grep for existing query patterns and naming conventions in the codebase before generating new code.- **Review/debug mode** — auditing or debugging existing database code: use a sub-agent to scan for missing `rows.Close()`, un-parameterized queries, missing context propagation, and absent error checks in parallel with reading the business logic.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This is a documentation-based Skill for writing and reviewing Go database code. It supplies no install commands or executable scripts, but declares code read/write, Go, git, and sub-agent permissions.

View source
SKILL.md:16In the instructionsOpen original file
        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:

The Skill requires sub-agents to scan repository query patterns and common database defects in write and review modes, so additional agents may read the project's Go source when it is used.

View source
SKILL.md:26In the instructionsOpen original file
- **Write mode** — generating new repository functions, query helpers, or transaction wrappers: follow the skill's sequential instructions; launch a background agent to grep for existing query patterns and naming conventions in the codebase before generating new code.- **Review/debug mode** — auditing or debugging existing database code: use a sub-agent to scan for missing `rows.Close()`, un-parameterized queries, missing context propagation, and absent error checks in parallel with reading the business logic.
SKILL.md:18In the instructionsOpen original file
allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:  - "**/*.go"---

The database guidance generally emphasizes parameterized queries, context propagation, closing result sets, transactions, and human review, and explicitly prohibits independently creating or dropping indexes.

View source
SKILL.md:40In the instructionsOpen original file
1. **Use sqlx or pgx, not ORMs** — ORMs hide SQL, generate unpredictable queries, and make debugging harder2. Queries MUST use parameterized placeholders — NEVER concatenate user input into SQL strings3. Context MUST be passed to all database operations — use `*Context` method variants (`QueryContext`, `ExecContext`, `GetContext`)4. `sql.ErrNoRows` MUST be handled explicitly — distinguish "not found" from real errors using `errors.Is`5. Rows MUST be closed after iteration — `defer rows.Close()` immediately after `QueryContext` calls6. NEVER use `db.Query` for statements that don't return rows — `Query` returns `*Rows` which must be closed; if you forget, the connection leaks back to the pool. Use `db.Exec` instead7. **Use transactions for multi-statement operations** — wrap related writes in `BeginTxx`/`Commit`8. **Use `SELECT ... FOR UPDATE`** when reading data you intend to modify — prevents race conditions
references/performance.md:183In the instructionsOpen original file
**Never create or drop indexes yourself.** Index changes affect production query performance and write throughput. Always suggest to the developer and let them decide.

The integration-test template obtains a database address from an environment variable and also provides a testcontainers example that pulls and starts PostgreSQL; these actions occur only when the user runs the generated integration tests.

View source
references/testing.md:131In the instructionsOpen original file
func (s *UserRepoSuite) SetupSuite() {    dsn := os.Getenv("TEST_DATABASE_URL") // e.g., postgres://test:test@localhost:5432/testdb?sslmode=disable    db, err := sqlx.Connect("postgres", dsn)    s.Require().NoError(err)    s.db = db    // Run migrations here if needed}
references/testing.md:182In the instructionsOpen original file
```gofunc (s *UserRepoSuite) SetupSuite() {    ctx := context.Background()    container, err := postgres.Run(ctx, "postgres:16-alpine",        postgres.WithDatabase("testdb"),        postgres.WithUsername("test"),        postgres.WithPassword("test"),        testcontainers.WithWaitStrategy(            wait.ForLog("database system is ready to accept connections").
Start here · InstructionsSKILL.md
golang-database
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 6 more sections are available in the original file.

File reference map

References: 4
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records6 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/performance.mdFull text included
  • references/scanning.mdFull text included
  • references/testing.mdFull text included
  • references/transactions.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/performance.mdSupporting file
  • references/scanning.mdSupporting file
  • references/testing.mdSupporting file
  • references/transactions.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🗄"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:212In the instructionsOpen original file
- [golang-migrate](https://github.com/golang-migrate/migrate) — CLI + Go library, supports all major databases- [Flyway](https://flywaydb.org/) — JVM-based, widely used in enterprise environments
SKILL.md:213In the instructionsOpen original file
- [golang-migrate](https://github.com/golang-migrate/migrate) — CLI + Go library, supports all major databases- [Flyway](https://flywaydb.org/) — JVM-based, widely used in enterprise environments- [Atlas](https://atlasgo.io/) — modern, declarative schema management
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
references/testing.md:173In the instructionsOpen original file
```bashgo test -tags=integration -v ./internal/repository/...
Read keys or account settings
references/testing.md:132In the instructionsOpen original file
func (s *UserRepoSuite) SetupSuite() {    dsn := os.Getenv("TEST_DATABASE_URL") // e.g., postgres://test:test@localhost:5432/testdb?sslmode=disable    db, err := sqlx.Connect("postgres", dsn)
Lines read
1,045
File checksum (to compare versions)
1332b042886e935f47078d043d93fe64a66c02867d5ace934f689087957f8b88