Golang Popular Libraries Skill Security Audit

16    install: []17allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch WebSearch AskUserQuestion mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*18---

2name: golang-popular-libraries3description: "Golang library and framework selection — vetted production-ready options by category (web, database, testing, logging, messaging), new and experimental stdlib packages, standard-library-first tradeoffs, and maturity signals (maintenance, license, importer counts). Apply when the user asks for library suggestions, wants to compare alternatives, needs to choose a library for a specific task, or when a new dependency is being added to the project. Not for a specific library's API once chosen (→ See that library's dedicated skill, e.g. `samber/cc-skills-golang@golang-samber-lo`), nor for go.mod mechanics, upgrades, or vulnerability audits (→ See `samber/cc-skills-golang@golang-dependency-management` skill)."4user-invocable: true

15        - go16    install: []17allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch WebSearch AskUserQuestion mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*18---

4041This skill is not exhaustive — refer to library documentation and code examples for more information:4243- When exploring a candidate library, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) for docs, symbols, versions, importers, and known vulnerabilities — prefer it over Context7 for Go package facts.44- Once a candidate is added to your build, → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`) to browse its actual resolved source and compare candidates side by side.45- Context7 remains a fallback for docs not indexed on pkg.go.dev.46

118119## Caching120121**hot** (<https://github.com/samber/hot>) In-memory caching library for Go with 9 eviction algorithms (LRU, LFU, TinyLFU, W-TinyLFU, S3FIFO, ARC, TwoQueue, SIEVE, FIFO), TTL, loaders with singleflight deduplication, sharding, and stale-while-revalidate.122123**Ristretto** (<https://github.com/dgraph-io/ristretto>) High-performance memory-bound Go cache.124

208209## Dependency Injection210211**do** (<https://github.com/samber/do>) Dependency injection library for Go. Simple, runtime DI with service locator pattern and health checks.212213**Wire** (<https://github.com/google/wire>) Code-generated dependency injection for Go. Compile-time dependency injection without reflection.214215**Dig** (<https://github.com/uber-go/dig>) Dependency injection container for Go. Runtime DI with lifecycle management.216217**Fx** (<https://github.com/uber-go/fx>) Application framework for Go. Built on Dig, provides lifecycle management, dependency injection, and observability.218219## Functional Programming & Utilities220221**lo** (<https://github.com/samber/lo>) A generics-based helper library for Go. Slice, map, and tuple operations with functional programming style.222223**mo** (<https://github.com/samber/mo>) Monads and functional programming helpers for Go. Option, Either, Try, and other functional patterns.224

218219## Functional Programming & Utilities220221**lo** (<https://github.com/samber/lo>) A generics-based helper library for Go. Slice, map, and tuple operations with functional programming style.222223**mo** (<https://github.com/samber/mo>) Monads and functional programming helpers for Go. Option, Either, Try, and other functional patterns.224

50511. **Assess requirements first** - Understand the use case, performance needs, and constraints522. **Check standard library** - Always consider if stdlib can solve the problem533. **Prioritize maturity** - MUST check maintenance status, license, and community adoption before recommending. Use a module's `imported-by` count on pkg.go.dev as a popularity and indirect quality signal — widely-imported libraries are more battle-tested and have stronger backward-compatibility pressure; → See `samber/cc-skills-golang@golang-pkg-go-dev` skill to count importers and compare alternatives544. **Consider complexity** - Simpler solutions are usually better in Go555. **Think about dependencies** - More dependencies = more attack surface and maintenance burden56

6869- → See `samber/cc-skills-golang@golang-dependency-management` skill for adding, auditing, and managing dependencies70- → See `samber/cc-skills-golang@golang-pkg-go-dev` skill to vet a candidate library on pkg.go.dev — versions, importers, licenses, and known vulnerabilities — before adopting it71- → See `samber/cc-skills-golang@golang-samber-do` skill for samber/do dependency injection details72- → See `samber/cc-skills-golang@golang-samber-hot` skill for samber/hot in-memory caching details73- → See `samber/cc-skills-golang@golang-samber-oops` skill for samber/oops error handling details74- → See `samber/cc-skills-golang@golang-stretchr-testify` skill for testify testing details75- → See `samber/cc-skills-golang@golang-grpc` skill for gRPC implementation details