Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Naming Skill Security Audit

What the author says it does (original text)

Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, Statu

Independent security check

Security risks found

Files checked
7
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Applying mandatory naming rules can cause broad, compatibility-breaking renames

Source references: 3
What we found

The Skill phrases many preferences as MUST/NEVER and explicitly says that applying the fixes means renaming existing identifiers. Renaming exported names, interface methods, constructors, or enum members can affect the entire workspace and external callers. The text itself acknowledges that manual edits can miss call sites or break interface satisfaction.

Why this matters

If an agent interprets a review request as authorization to refactor, the user may receive persistent cross-file changes, build failures, broken interface implementations, or incompatible public APIs.

The Skill is allowed to Edit/Write and explicitly says applying its fixes means renaming existing identifiers. If used to apply naming fixes during a refactor, changes to exported APIs, interface methods, or enum names could affect callers inside and outside the workspace. It acknowledges that manual edits can miss call sites or break interface satisfaction, then refers to another Skill not included here. A user can restrict it to read-only review or require a rename-impact list and call-site verification first.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Show 2 other places
SKILL.md:65In the instructionsOpen original file
All Go identifiers MUST use `MixedCaps` (or `mixedCaps`). NEVER use underscores in identifiers — the only exceptions are test function subcases (`TestFoo_InvalidInput`), generated code, and OS/cgo interop. This is load-bearing, not cosmetic — Go's export mechanism relies on capitalization, and tooling assumes MixedCaps throughout.
SKILL.md:157In the instructionsOpen original file
Applying these fixes means renaming existing identifiers — → See `samber/cc-skills-golang@golang-gopls` skill to do it safely: its rename updates every call site across the workspace and refuses a rename that would break interface satisfaction, which a grep/sed or manual Edit-based rename silently misses.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The naming guide requests Git and Agent permissions beyond a read-only review

Source references: 3
What we found

The manifest permits Bash(git:*) and Agent without limiting Git to read-only subcommands. Naming advice does not inherently require pushing, resetting, deleting branches, committing, or delegation. The source does not direct those actions, but the permission scope enables them in a harness that honors it.

Why this matters

If the host grants every Git subcommand through the wildcard, a mistaken or manipulated agent could alter commit history, remote state, or the worktree. Agent delegation also expands the set of actors able to access repository content and perform actions.

The manifest permits any git subcommand and Agent delegation, while the stated purpose is Go naming decisions and the body provides no workflow requiring commits, pushes, resets, branch deletion, or delegation. Those capabilities exceed the core purpose. Risk arises only if the runtime grants them and the agent invokes them; the source does not show that it will. A user can disable Agent and restrict Git to read-only operations such as status and diff.

SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Show 2 other places
SKILL.md:2In the instructionsOpen original file
---name: golang-namingdescription: "Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, StatusReady vs StatusUnknown at iota 0), debating Go package names (utils/helpers anti-patterns), or asking about Go naming best practices. Also trigger when the user mentions MixedCaps vs snake_case, ALL_CAPS constants, Get-prefix on getters, or error string casing. Do NOT use for general Go implementation questions that don't involve naming decisions."user-invocable: true
SKILL.md:3In the instructionsOpen original file
name: golang-namingdescription: "Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, StatusReady vs StatusUnknown at iota 0), debating Go package names (utils/helpers anti-patterns), or asking about Go naming best practices. Also trigger when the user mentions MixedCaps vs snake_case, ALL_CAPS constants, Get-prefix on getters, or error string casing. Do NOT use for general Go implementation questions that don't involve naming decisions."user-invocable: true
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Low risk

The Skill recommends invoking other Skills outside this audit

Source references: 3
What we found

The Skill directs the agent toward golang-gopls, golang-lint, golang-code-style, golang-refactoring, and other external Skills. Their content, permissions, and installation behavior are absent from the supplied source, so this audit cannot cover them.

Why this matters

If the environment automatically resolves or installs these recommendations, the user may expand code-modification, command-execution, or supply-chain trust without a separate review.

The Skill explicitly directs the agent toward other Skills, including golang-gopls, golang-lint, golang-code-style, and golang-refactoring; the gopls reference concerns workspace-wide renaming. Their instructions, scripts, and permissions are absent from the supplied source, so they cannot be assessed here. Nothing shown automatically installs or invokes them; exposure begins only if the user or agent later loads them. A user can require a separate source and permission audit before enabling them.

SKILL.md:157In the instructionsOpen original file
Applying these fixes means renaming existing identifiers — → See `samber/cc-skills-golang@golang-gopls` skill to do it safely: its rename updates every call site across the workspace and refuses a rename that would break interface satisfaction, which a grep/sed or manual Edit-based rename silently misses.
Show 2 other places
SKILL.md:161In the instructionsOpen original file
Many naming convention issues are caught automatically by linters: `revive`, `predeclared`, `misspell`, `errname`. See `samber/cc-skills-golang@golang-lint` skill for configuration and usage.
SKILL.md:165In the instructionsOpen original file
- → See `samber/cc-skills-golang@golang-code-style` skill for broader formatting and style decisions- → See `samber/cc-skills-golang@golang-structs-interfaces` skill for interface naming depth and receiver design- → See `samber/cc-skills-golang@golang-lint` skill for automated enforcement (revive, predeclared, misspell, errname)- → See `samber/cc-skills-golang@golang-gopls` skill for safe rename when applying a naming fix- → See `samber/cc-skills-golang@golang-refactoring` skill for how to apply a rename safely at scale (gopls Rename/Inline, blast-radius mapping, staged PR workflow) once you've decided what to rename identifiers to
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill provides naming rules for Go code and explicitly covers writing, reviewing, and refactoring. Its rules address identifiers, constructors, boolean fields, errors, enums, and test names.

View source
SKILL.md:2In the instructionsOpen original file
---name: golang-namingdescription: "Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, StatusReady vs StatusUnknown at iota 0), debating Go package names (utils/helpers anti-patterns), or asking about Go naming best practices. Also trigger when the user mentions MixedCaps vs snake_case, ALL_CAPS constants, Get-prefix on getters, or error string casing. Do NOT use for general Go implementation questions that don't involve naming decisions."user-invocable: truelicense: MIT
SKILL.md:34In the instructionsOpen original file
## Quick Reference| Element | Convention | Example || --- | --- | --- |

The manifest declares no installation steps, but requests reading, editing, writing, Go/linter/Git commands, and Agent delegation. These are capability declarations, not evidence that any command or modification has occurred.

View source
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:

The main file delegates detailed rules to five included reference files, all of which are present in the supplied source. It also recommends several other community Skills that are outside this reviewed source.

View source
SKILL.md:116In the instructionsOpen original file
For complete rules, examples, and rationale, see:- **[Packages, Files & Import Aliasing](./references/packages-files.md)** — Package naming (single word, lowercase, no plurals), file naming conventions, import alias patterns (only use on collision to avoid cognitive load), and directory structure.- **[Variables, Booleans, Receivers & Acronyms](./references/identifiers.md)** — Scope-based naming (length matches scope: `i` for 3-line loops, longer names for package-level), single-letter receiver conventions (`s` for Server), acronym casing (URL not Url, HTTPServer not HttpServer), and boolean naming patterns (isReady, hasPrefix).- **[Functions, Methods & Options](./references/functions-methods.md)** — Getter/setter patterns (Go omits `Get` so `user.Name()` reads naturally), constructor conventions (`New` or `NewTypeName`), named returns (for documentation only), format function suffixes (`Errorf`, `Wrapf`), and functional options (`WithPort`, `WithLogger`).- **[Types, Constants & Errors](./references/types-errors.md)** — Interface naming (`Reader`, `Closer` suffix with `-er`), struct naming (nouns, MixedCaps), constants (MixedCaps, not ALL_CAPS), enums (type name prefix like `StatusReady`), sentinel errors (`ErrNotFound` variables), error types (`PathError` suffix), and error message conventions (lowercase, no punctuation).
SKILL.md:126In the instructionsOpen original file
- **[Test Naming](./references/testing.md)** — Test function naming (`TestFunctionName`), table-driven test field conventions (`input`, `expected`), test helper naming, and subcase naming patterns.
Start here · InstructionsSKILL.md
golang-naming
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 5
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records7 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/functions-methods.mdFull text included
  • references/identifiers.mdFull text included
  • references/packages-files.mdFull text included
  • references/testing.mdFull text included
  • references/types-errors.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/functions-methods.mdSupporting file
  • references/identifiers.mdSupporting file
  • references/packages-files.mdSupporting file
  • references/testing.mdSupporting file
  • references/types-errors.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🏷"    homepage: https://github.com/samber/cc-skills-golang    requires:
evals/evals.json:300In the instructionsOpen original file
    "description": "Tests WithContext suffix for context variants and In suffix for in-place mutations",    "prompt": "I have a Go data processing library. I need to add variants to existing functions:\n\n1. `Fetch(key string) ([]byte, error)` needs a variant that accepts a context.Context\n2. `Sort(items []Item) []Item` (returns a new sorted slice) needs an in-place variant that modifies the slice directly\n3. `ParseConfig(path string) (*Config, error)` needs a variant that panics instead of returning an error\n4. `Reverse(s string) string` (returns a new string) needs an in-place variant for byte slices\n5. `Query(sql string) (*Rows, error)` needs a context-aware variant\n\nWhat should the variant function names be? Write the signatures.",    "trap": "Model uses FetchCtx/FetchWithCtx instead of FetchWithContext, SortMut/SortSlice instead of SortIn, or ParseConfigOrPanic instead of MustParseConfig.",
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Change files
references/functions-methods.md:21In the instructionsOpen original file
// Verb-like: performs an actionfunc WriteFile(name string, data []byte) error { ... }func SendNotification(user *User) error { ... }
Lines read
1,186
File checksum (to compare versions)
8baf88e53325e10e2b8ee54627462f5b44da4451c9d1bd59ee1895187c244798