Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Grpc Skill Security Audit

What the author says it does (original text)

Provides gRPC usage guidelines, protobuf organization, and production-ready patterns for Golang microservices. Use when implementing, reviewing, or debugging gRPC servers/clients, writing proto files, setting up interceptors, handling gRPC errors with status codes, configuring TLS/mTLS, testing with bufconn, or working with streaming RPCs.

Independent security check

Security risks found

Files checked
4
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Installation instructions fetch executable tools at unpinned versions

Source references: 1
What we found

Both Go code generators are installed with `@latest`. The code downloaded and later executed therefore depends on the upstream release current at installation time, rather than a fixed version covered by this review.

Why this matters

If an upstream account, release process, or dependency is compromised—or a latest release is incompatible—the user may install and run unreviewed code, and generated output may change unexpectedly.

The dependency instructions explicitly install two executable code generators using `@latest`. When run, they download whatever upstream version is current, making installation non-reproducible and placing that supply-chain content outside the provided source audit. There is no evidence that the upstream packages are malicious, but version drift or a compromised release could affect the machine or generated code. Users can ask for verified pinned versions and install them in an isolated environment.

SKILL.md:33In the instructionsOpen original file
**Dependencies:**- protoc: `brew install protobuf`- protoc-gen-go: `go install google.golang.org/protobuf/cmd/protoc-gen-go@latest`- protoc-gen-go-grpc: `go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest`
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The example returns internal error text to remote clients

Source references: 2
What we found

The `codes.Internal` example interpolates the underlying `err` into the gRPC status message with `%v`. That message is returned over RPC and may contain database errors, internal addresses, query content, or implementation details. It also directly conflicts with the included evaluation requirement not to leak internal error details.

Why this matters

A service adopting the example could expose internal system information to untrusted clients and assist further probing.

The skill’s recommended handling interpolates the underlying error with `%v` into a `codes.Internal` status message. If adopted, that message is returned to the RPC caller and may expose queries, hostnames, or other implementation details contained in the error. The bundled evaluation explicitly requires Internal messages not to leak such details, confirming an internal inconsistency. Users can ask the author to use a fixed client-facing message and keep the original error only in controlled server logs.

SKILL.md:155In the instructionsOpen original file
// ✓ Good — specific code lets clients act appropriatelyif errors.Is(err, ErrNotFound) {    return nil, status.Errorf(codes.NotFound, "user %q not found", req.UserId)}return nil, status.Errorf(codes.Internal, "lookup failed: %v", err)```
Show 1 other places
evals/evals.json:26In the instructionsOpen original file
      {        "id": "1.5",        "text": "Does NOT leak internal error details in the user-facing gRPC message for Internal errors"      }
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The global retry policy can repeat non-idempotent RPCs

Source references: 1
What we found

The example attaches an `UNAVAILABLE` retry policy to a default method configuration with an empty service name, without limiting it to identified read-only or idempotent methods. If an order, payment, or write completes on the server but its response is lost as `UNAVAILABLE`, the client may attempt it up to three times.

Why this matters

This can cause duplicate orders, writes, notifications, or even charges.

The example’s `methodConfig` uses an empty service name rather than naming methods known to be safe to retry, while allowing up to three attempts for `UNAVAILABLE`. If copied into a client containing non-idempotent create or payment methods, a lost response after server-side completion could cause duplicate side effects. Users can ask the author to scope retries to explicitly idempotent methods and require idempotency keys or server-side deduplication for writes.

SKILL.md:116In the instructionsOpen original file
    grpc.WithTransportCredentials(creds),    grpc.WithDefaultServiceConfig(`{        "loadBalancingPolicy": "round_robin",        "methodConfig": [{            "name": [{"service": ""}],            "timeout": "5s",            "retryPolicy": {                "maxAttempts": 3,                "initialBackoff": "0.1s",                "maxBackoff": "1s",                "backoffMultiplier": 2,                "retryableStatusCodes": ["UNAVAILABLE"]            }        }]    }`),)

Inside this skill

8 instruction sections

The Skill mainly guides an agent in building or reviewing Go gRPC services, including proto organization, client/server implementation, error handling, TLS, streaming RPCs, and testing.

View source
SKILL.md:26In the instructionsOpen original file
**Persona:** You are a Go distributed systems engineer. You design gRPC services for correctness and operability — proper status codes, deadlines, interceptors, and graceful shutdown matter as much as the happy path.**Modes:**- **Build mode** — implementing a new gRPC server or client from scratch.- **Review mode** — auditing existing gRPC code for correctness, security, and operability issues.

Its declared capabilities include not only reading and changing files, but also running Go, protoc, and git commands, fetching web content, and starting agents; its path rule matches all Go files. Its enabled permission surface is therefore broader than a documentation-only reference.

View source
SKILL.md:21In the instructionsOpen original file
        bins: [protoc]allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(protoc:*) AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:  - "**/*.go"---

The Skill explicitly recommends production TLS, token validation, and disabling reflection, which are safeguards against credential exposure and API enumeration.

View source
SKILL.md:191In the instructionsOpen original file
## Security- TLS MUST be enabled in production — credentials travel in metadata- For service-to-service auth, use mTLS or delegate to a service mesh (Istio, Linkerd)- For user auth, implement `credentials.PerRPCCredentials` and validate tokens in an auth interceptor- Reflection SHOULD be disabled in production to prevent API discovery
Start here · InstructionsSKILL.md
golang-grpc
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/protoc-reference.mdFull text included
  • references/testing.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/protoc-reference.mdSupporting file
  • references/testing.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🌐"    homepage: https://github.com/samber/cc-skills-golang    requires:
Run commands
SKILL.md:21In the instructionsOpen original file
        bins: [protoc]allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(protoc:*) AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
references/protoc-reference.md:74In the instructionsOpen original file
```bash# Basic generation
references/protoc-reference.md:136In the instructionsOpen original file
```bashbuf generate              # Generate code from buf.gen.yaml
Install extra software packages
SKILL.md:35In the instructionsOpen original file
- protoc: `brew install protobuf`- protoc-gen-go: `go install google.golang.org/protobuf/cmd/protoc-gen-go@latest`
Read keys or account settings
SKILL.md:60In the instructionsOpen original file
| Testing | `google.golang.org/grpc/test/bufconn` || TLS / mTLS | `google.golang.org/grpc/credentials` || Health checks | `google.golang.org/grpc/health` |
SKILL.md:115In the instructionsOpen original file
conn, err := grpc.NewClient("dns:///user-service:50051",    grpc.WithTransportCredentials(creds),    grpc.WithDefaultServiceConfig(`{
SKILL.md:193In the instructionsOpen original file
- TLS MUST be enabled in production — credentials travel in metadata- For service-to-service auth, use mTLS or delegate to a service mesh (Istio, Linkerd)
Lines read
981
File checksum (to compare versions)
b829526aa60cf1b5e1d7a7d1f550dd37fd7fbe20ff4546f906cf00668d081cf8