Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Lint Skill Security Audit

What the author says it does (original text)

Linting best practices and golangci-lint configuration for Golang projects — running linters, configuring .golangci.yml, suppressing warnings with nolint directives, interpreting lint output, and selecting linters. Use when configuring golangci-lint, asking about lint warnings or nolint suppressions, setting up code quality tooling, or choosing linters. Also use when the user mentions golangci-lin

Independent security check

Security risks found

Files checked
5
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Dependency installation uses an unpinned `latest` release

Source references: 1
What we found

The installation command fetches and builds the current golangci-lint release from GitHub without a fixed version or checksum. The same instruction can therefore retrieve different code and dependencies over time.

Why this matters

If an upstream release, dependency chain, or distribution account is compromised, installation or later execution of the binary could run unintended code with the user's permissions. Even without compromise, version drift can change automated-fix results.

The dependency section provides an executable `go install ...@latest` command, which fetches whatever release and transitive dependencies are current at installation time, without a pinned version or verification step. It installs a binary with the user's permissions. This is not evidence of malicious behavior, but it reduces reproducibility and increases exposure to upstream supply-chain changes. A user can ask for a tested fixed version and documented checksum or release verification.

SKILL.md:37In the instructionsOpen original file
**Dependencies:**- golangci-lint: `go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest`
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Automatic fixes can concurrently rewrite Go files across the project

Source references: 2
What we found

The Skill explicitly directs a background auto-fix during ordinary coding and multiple simultaneous fixing agents during legacy cleanup. One instructed command targets `./...`, which can modify the entire Go module rather than only files the user is reviewing.

Why this matters

Formatting, imports, and some code structures may change while the main task is still underway. Agents editing related files concurrently can also create conflicts, overwrite unchecked work, or produce a broad diff that is difficult to review.

The source supports this risk. Coding mode directs a background agent to run `--fix` on modified files, while legacy-cleanup mode directs up to five agents to edit concurrently, including an auto-fix over `./...`. This occurs only when those modes are used with authorization to modify the project. It can rewrite files across the Go module and create concurrent-edit conflicts. A user can require a read-only lint run first, restrict the file set, and prohibit concurrent writers.

SKILL.md:34In the instructionsOpen original file
- **Setup mode** — configuring `.golangci.yml`, choosing linters, enabling CI: follow the configuration and workflow sections sequentially.- **Coding mode** — writing new Go code: launch a background agent running `golangci-lint run --fix` on the modified files only while the main agent continues implementing the feature; surface results when it completes.- **Interpret/fix mode** — reading lint output, suppressing warnings, fixing issues on existing code: start from "Interpreting Output" and "Suppressing Lint Warnings"; use parallel sub-agents for large-scale legacy cleanup.
Show 1 other places
SKILL.md:147In the instructionsOpen original file
When adopting linting on a legacy codebase, use up to 5 parallel sub-agents to fix independent linter categories simultaneously:- Sub-agent 1: Run `golangci-lint run --fix ./...` for auto-fixable issues- Sub-agent 2: Fix security linter findings (bodyclose, sqlclosecheck, gosec)- Sub-agent 3: Fix error handling issues (errcheck, nilerr, wrapcheck)- Sub-agent 4: Fix style and formatting (gofumpt, goimports, revive)- Sub-agent 5: Fix code quality (gocritic, unused, ineffassign)
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill configures and runs golangci-lint. It declares permission to read, edit, and write Go source files and `.golangci.yml`, and to run Go, golangci-lint, and Git commands.

View source
SKILL.md:21In the instructionsOpen original file
        bins: [golangci-lint]allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:  - "**/*.go"  - ".golangci.yml"---

The recommended configuration checks test files, runs up to four analyses concurrently, and enables correctness, style, complexity, security, resource, logging, and testing checks.

View source
assets/.golangci.yml:2In the instructionsOpen original file
version: "2"run:  concurrency: 4  # Timeout for analysis  timeout: 5m  # Include test files  tests: true
assets/.golangci.yml:47In the instructionsOpen original file
    - goconst # repeated literals that should be constants    # security & resources    - gosec # security scanner: SQL injection, hardcoded credentials, weak crypto, path traversal    - bidichk # dangerous bidirectional Unicode sequences (trojan source CVE-2021-42574)    - bodyclose # unclosed HTTP response bodies (connection leaks)    - noctx # HTTP requests missing context.Context    - containedctx # context.Context stored in struct fields instead of passed as parameter    - fatcontext # context.WithValue/WithCancel in loops (unbounded context chain, memory leak)    - sqlclosecheck # unclosed sql.Rows and sql.Stmt    - rowserrcheck # unchecked sql.Rows.Err() after iteration    # logging

The documentation generally requires fixing root causes first and requires each `nolint` suppression to name the linter and give a reason; security and resource-leak checks should not be casually suppressed.

View source
SKILL.md:77In the instructionsOpen original file
Use `//nolint` directives sparingly — fix the root cause first.
SKILL.md:91In the instructionsOpen original file
1. **//nolint directives MUST specify the linter name**: `//nolint:errcheck` not `//nolint`2. **//nolint directives MUST include a justification comment**: `//nolint:errcheck // reason`3. **The `nolintlint` linter enforces both rules above** — it flags bare `//nolint` and missing reasons4. **NEVER suppress security linters** (gosec, bodyclose, sqlclosecheck) without a very strong reason
Start here · InstructionsSKILL.md
golang-lint
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.

File reference map

References: 4
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • assets/.golangci.ymlFull text included
  • references/linter-reference.mdFull text included
  • references/nolint-directives.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • assets/.golangci.ymlSupporting file
  • evals/evals.jsonSupporting file
  • references/linter-reference.mdSupporting file
  • references/nolint-directives.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🧹"    homepage: https://github.com/samber/cc-skills-golang    requires:
Run commands
SKILL.md:21In the instructionsOpen original file
        bins: [golangci-lint]allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
SKILL.md:51In the instructionsOpen original file
```bash# Run all configured linters
Read keys or account settings
assets/.golangci.yml:48In the instructionsOpen original file
    # security & resources    - gosec # security scanner: SQL injection, hardcoded credentials, weak crypto, path traversal    - bidichk # dangerous bidirectional Unicode sequences (trojan source CVE-2021-42574)
references/linter-reference.md:90In the instructionsOpen original file
- **gosec** — Security scanner: SQL injection, hardcoded credentials, weak crypto, path traversal, unsafe usage, and 50+ other rules. The primary SAST tool in the config — never suppress without strong justification.- **bidichk** — Detects dangerous bidirectional Unicode sequences (CVE-2021-42574 trojan source attack — code that looks safe but executes differently)
Lines read
814
File checksum (to compare versions)
378c4779dc8009bd787d94d45c9c5d727838771880744b76cbc5e0f32c42591d