Golang Modernize Skill Security Audit

11    emoji: "🔄"12    homepage: https://github.com/samber/cc-skills-golang13    requires:

76| ------- | ------------- | --------------------------- |77| Go 1.21 | August 2023   | <https://go.dev/doc/go1.21> |78| Go 1.22 | February 2024 | <https://go.dev/doc/go1.22> |

77| Go 1.21 | August 2023   | <https://go.dev/doc/go1.21> |78| Go 1.22 | February 2024 | <https://go.dev/doc/go1.22> |79| Go 1.23 | August 2024   | <https://go.dev/doc/go1.23> |

17    skill-library-version: "1.27"18allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch WebSearch AskUserQuestion EnterWorktree ExitWorktree19paths:

89```bash10# Check current version

2930```bash31# Pin in the module (Go 1.24+)

35      "name": "safety-over-cosmetic",36      "prompt": "Modernize this Go 1.24 HTTP file server code. Suggest all improvements.\n\n```go\npackage fileserver\n\nimport (\n    \"fmt\"\n    \"io\"\n    \"net/http\"\n    \"os\"\n    \"path/filepath\"\n)\n\ntype FileServer struct {\n    baseDir string\n}\n\nfunc NewFileServer(baseDir string) *FileServer {\n    return &FileServer{baseDir: baseDir}\n}\n\nfunc (fs *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n    userPath := r.URL.Query().Get(\"path\")\n    if userPath == \"\" {\n        http.Error(w, \"missing path parameter\", http.StatusBadRequest)\n        return\n    }\n\n    fullPath := filepath.Join(fs.baseDir, filepath.Clean(userPath))\n\n    f, err := os.Open(fullPath)\n    if err != nil {\n        http.Error(w, \"file not found\", http.StatusNotFound)\n        return\n    }\n    defer f.Close()\n\n    w.Header().Set(\"Content-Type\", \"application/octet-stream\")\n    io.Copy(w, f)\n}\n\nfunc process(data interface{}) interface{} {\n    return data\n}\n\nfunc minVal(a, b int) int {\n    if a < b { return a }\n    return b\n}\n\nfunc formatAddr(host string, port int) string {\n    return fmt.Sprintf(\"%s:%d\", host, port)\n}\n```\n\nThe project targ …37      "trap": "The code has a path traversal vulnerability (filepath.Join + filepath.Clean is insufficient). Without the skill, the model may prioritize cosmetic changes (interface{}->any, min builtin) over the security-critical os.Root fix …

103      "name": "addcleanup-vs-setfinalizer",104      "prompt": "Review this resource management code for Go 1.24 best practices.\n\n```go\npackage pool\n\nimport (\n    \"database/sql\"\n    \"fmt\"\n    \"runtime\"\n)\n\ntype ManagedConn struct {\n    db   *sql.DB\n    name string\n    dsn  string\n}\n\nfunc NewManagedConn(dsn, name string) (*ManagedConn, error) {\n    db, err := sql.Open(\"postgres\", dsn)\n    if err != nil {\n        return nil, fmt.Errorf(\"opening db: %w\", err)\n    }\n    mc := &ManagedConn{db: db, name: name, dsn: dsn}\n    runtime.SetFinalizer(mc, func(c *ManagedConn) {\n        c.db.Close()\n    })\n    return mc, nil\n}\n\ntype TempFile struct {\n    path string\n    fd   int\n}\n\nfunc NewTempFile(path string, fd int) *TempFile {\n    tf := &TempFile{path: path, fd: fd}\n    runtime.SetFinalizer(tf, func(f *TempFile) {\n        syscallClose(f.fd)\n        osRemove(f.path)\n    })\n    return tf\n}\n\nfunc syscallClose(fd int) {}\nfunc osRemove(path string) {}\n```\n\nModernize the cleanup pattern. Explain why the current approach has problems.",105      "trap": "New Go code should consider runtime.AddCleanup instead of runtime.SetFinalizer because it is less error-prone. The key API difference: AddCleanup takes the resource as a separate argument (not the whole object). Without the s …

422path := filepath.Join(baseDir, userInput)423data, err := os.ReadFile(path)424

89      "name": "cmp-or-chained-defaults",90      "prompt": "Clean up this configuration loading code. We're on Go 1.22. The nested if/else chains for default values are hard to read.\n\n```go\npackage config\n\nimport \"os\"\n\ntype Config struct {\n    Host     string\n    Port     string\n    LogLevel string\n    Region   string\n    Mode     string\n}\n\nfunc LoadConfig() Config {\n    host := os.Getenv(\"HOST\")\n    if host == \"\" {\n        host = os.Getenv(\"HOSTNAME\")\n    }\n    if host == \"\" {\n        host = os.Getenv(\"SERVICE_HOST\")\n    }\n    if host == \"\" {\n        host = \"localhost\"\n    }\n\n    port := os.Getenv(\"PORT\")\n    if port == \"\" {\n        port = os.Getenv(\"HTTP_PORT\")\n    }\n    if port == \"\" {\n        port = \"8080\"\n    }\n\n    logLevel := os.Getenv(\"LOG_LEVEL\")\n    if logLevel == \"\" {\n        logLevel = os.Getenv(\"LOGLEVEL\")\n    }\n    if logLevel == \"\" {\n        logLevel = \"info\"\n    }\n\n    region := os.Getenv(\"AWS_REGION\")\n    if region == \"\" {\n        region = os.Getenv(\"REGION\")\n    }\n    if region == \"\" {\n        region = \"us-east-1\"\n    }\n\n    mode := os.Getenv(\"APP_MODE\")\n    if mode == \"\" {\n        mode = \"production\"\n …91      "trap": "Go 1.22 introduced cmp.Or(a, b, c...) which returns the first non-zero value. It collapses multi-step default chains to single lines. Without the skill, the model will likely keep the if/else chains or use a custom helper fun …

174// Before175addr := os.Getenv("ADDR")176if addr == "" { addr = ":8080" }

178// After (Go 1.22+)179addr := cmp.Or(os.Getenv("ADDR"), ":8080")180```

302      "name": "go127-synctest-http",303      "prompt": "This Go 1.27 HTTP handler test is flaky in CI because of real timeouts. Make it deterministic and fast.\n\n```go\npackage api\n\nimport (\n    \"io\"\n    \"net/http\"\n    \"net/http/httptest\"\n    \"testing\"\n    \"time\"\n)\n\nfunc Handler(w http.ResponseWriter, r *http.Request) {\n    time.Sleep(100 * time.Millisecond) // simulates slow backend\n    w.Write([]byte(\"ok\"))\n}\n\nfunc TestHandlerResponds(t *testing.T) {\n    srv := httptest.NewServer(http.HandlerFunc(Handler))\n    defer srv.Close()\n\n    client := &http.Client{Timeout: 5 * time.Second}\n    resp, err := client.Get(srv.URL)\n    if err != nil {\n        t.Fatal(err)\n    }\n    defer resp.Body.Close()\n    body, _ := io.ReadAll(resp.Body)\n    if string(body) != \"ok\" {\n        t.Fatalf(\"got %q\", body)\n    }\n}\n\nfunc TestHandlerClientTimeout(t *testing.T) {\n    srv := httptest.NewServer(http.HandlerFunc(Handler))\n    defer srv.Close()\n\n    client := &http.Client{Timeout: 50 * time.Millisecond} // shorter than handler sleep\n    _, err := client.Get(srv.URL)\n    if err == nil {\n        t.Fatal(\"expected timeout error\")\n    }\n}\n```\n\nProvide the fixed tests. Do not just incre …304      "trap": "testing/synctest makes time-based tests deterministic, but a plain httptest.NewServer uses the real network, which stalls inside a synctest bubble (the bubble's fake clock waits forever on real I/O). Go 1.27 added httptest.Ne …