Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Safety Skill Security Audit

What the author says it does (original text)

Defensive Golang coding against accidental bugs — nil panics, typed-nil interfaces, `append` backing-array aliasing, silent int64-to-int32 truncation, float `==` comparison, `defer` inside loops, defensive copies of slices and maps, and usable zero values. Use when a Go program panics on a nil map write or nil pointer dereference, when reviewing code for nil-safety, numeric conversion overflow, or

Independent security check

Security risks found

Files checked
4
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The recommended lazy database initialization example discards errors and prevents retry

Source references: 2
What we found

Inside sync.Once, the example discards the error from sql.Open with an underscore and then returns db.conn unconditionally. Because Once runs only once, a failed first initialization is never attempted again.

Why this matters

If an agent copies this into real database code, driver, configuration, or initialization errors may be hidden. Callers can receive a nil or unusable connection, causing later failures or service outage while preventing automatic recovery.

This is instructional sample code, not automatically executed behavior, but the risk applies if a user adopts it. sync.Once runs the initializer only once, while the sql.Open error is discarded with `_`; callers cannot detect initialization failure or trigger a retry and may receive a nil or unusable connection. A user can ask the author for an example that returns `(*sql.DB, error)`, preserves and checks the initialization error, and defines an explicit retry policy.

SKILL.md:40In the instructionsOpen original file
10. **Design useful zero values** — nil map fields panic on first write; use lazy init11. **Use `sync.Once` for lazy init** — guarantees exactly-once even under concurrency
Show 1 other places
SKILL.md:232In the instructionsOpen original file
func (db *DB) connection() *sql.DB {    db.once.Do(func() {        db.conn, _ = sql.Open("postgres", connStr)    })    return db.conn}```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Declared permissions exceed what a read-only Go safety review needs

Source references: 2
What we found

The Skill declares file editing and writing, every command matching git:*, and Agent access. Although its description includes code-writing use cases, it does not restrict these permissions to target Go files, test commands, or user-approved changes.

Why this matters

If the host enforces this declaration, an agent invoked for an ordinary safety review may also be able to modify the repository and alter Git state. The permission alone does not prove it will do so, but it increases the effect of mistakes or conflicting prompts.

The declaration permits Edit, Write, every command matching git:*, and Agent. git:* can include operations that alter files, repository history, or remotes. Editing is not wholly unrelated because the stated purpose includes writing Go code, but the Skill does not constrain Git/Agent use or require per-operation approval. Impact exists only if the host grants these tools and the model invokes them. A user can ask the author to narrow permissions to required Go/test commands and have the host disable writes, remote Git operations, and Agent access.

SKILL.md:3In the instructionsOpen original file
name: golang-safetydescription: "Defensive Golang coding against accidental bugs — nil panics, typed-nil interfaces, `append` backing-array aliasing, silent int64-to-int32 truncation, float `==` comparison, `defer` inside loops, defensive copies of slices and maps, and usable zero values. Use when a Go program panics on a nil map write or nil pointer dereference, when reviewing code for nil-safety, numeric conversion overflow, or resource lifecycle, or when designing a type whose zero value must be safe. Not for designing concurrent access with goroutines, channels, or sync primitives (→ See `samber/cc-skills-golang@golang-concurrency` skill), not for exploitable vulnerabilities such as injection, weak crypto, or leaked secrets (→ See `samber/cc-skills-golang@golang-security` skill), and not for debugging an already-failing program (→ See `samber/cc-skills-golang@golang-troubleshooting` skill)."user-invocable: true
Show 1 other places
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill mainly guides Go code handling for nil values, slice aliasing, numeric conversions, resource cleanup, and zero-value design. It provides guidance and examples rather than installation scripts.

View source
SKILL.md:24In the instructionsOpen original file
# Go Safety: Correctness & Defensive CodingPrevents programmer mistakes — bugs, panics, and silent data corruption in normal (non-adversarial) code. Security handles attackers; safety handles ourselves.

The declared installation list is empty and only Go is listed as a required program; the supplied files contain no visible dependency-installation or network-download step.

View source
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent

The material in evals/evals.json consists of test prompts, trap descriptions, and assertions, not live operating instructions for the Skill. It mainly checks whether generated Go code follows defensive rules.

View source
evals/evals.json:3In the instructionsOpen original file
  {    "id": 1,    "name": "typed-nil-error-interface-trap",    "description": "Returns untyped nil on success, not typed *ConfigError nil pointer through error interface",    "prompt": "In package `validator`, write a function `Validate(cfg Config) error` where Config has fields `Host string` and `Port int`. The function should check if Host is empty or Port is out of range (1-65535). Use a local `*ConfigError` variable to accumulate the first error found, then return it at the end. ConfigError is a struct with a `Field string` and an `Error() string` method.\n\nWrite the full code including the Config struct, ConfigError struct with its Error method, and the Validate function.",    "trap": "Model declares `var configErr *ConfigError` and returns it directly — `return configErr` wraps a typed nil pointer in the error interface, making the returned error non-nil even when configErr is nil",    "assertions": [      {        "id": "1.1",        "text": "Returns untyped nil on valid config — the success path must use `return nil` (not `return configErr` where configErr is *ConfigError), because a typed nil pointer wrapped in an error interface is non-nil"      },
Start here · InstructionsSKILL.md
golang-safety
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/nil-safety.mdFull text included
  • references/slice-map-safety.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/nil-safety.mdSupporting file
  • references/slice-map-safety.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🛡"    homepage: https://github.com/samber/cc-skills-golang    requires:
evals/evals.json:535In the instructionsOpen original file
    "description": "Both OnRequest and OnResponse checked for nil before calling",    "prompt": "In package `http`, write a struct `Client` with fields `OnRequest func(url string)` and `OnResponse func(status int)`. Add a `Fetch(url string) (int, error)` method that calls OnRequest before fetching, does the fetch (simulate with status 200), and calls OnResponse after. Keep it simple.",    "trap": "Model guards OnRequest but forgets OnResponse, or neither — calling a nil func panics at runtime for any callback that was never set",
evals/evals.json:548In the instructionsOpen original file
        "id": "22.3",        "text": "Client is usable with zero-value callbacks — `Client{}.Fetch(url)` should not panic"      },
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
Read files
SKILL.md:167In the instructionsOpen original file
for _, path := range paths {    f, _ := os.Open(path)    defer f.Close() // deferred until function exits
SKILL.md:177In the instructionsOpen original file
func processOne(path string) error {    f, err := os.Open(path)    if err != nil { return err }
SKILL.md:234In the instructionsOpen original file
    db.once.Do(func() {        db.conn, _ = sql.Open("postgres", connStr)    })
Lines read
1,638
File checksum (to compare versions)
e09227a62185071158b9f78c2b5737779601f60047b5df551efc50ccad1cada1