Skip to content
Report library
Purpose / Development

Golang Samber Hot Skill Security Audit

What the author says it does (original text)

In-memory caching in Golang using samber/hot — eviction algorithms (LRU, LFU, TinyLFU, W-TinyLFU, S3FIFO, ARC, TwoQueue, SIEVE, FIFO), TTL, cache loaders, sharding, stale-while-revalidate, missing key caching, and Prometheus metrics. Apply when using or adopting samber/hot, when the codebase imports github.com/samber/hot, or when the project repeatedly loads the same medium-to-low cardinality reso

Independent security check

Security risks found

Files checked
5
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The example's shallow copy does not isolate slices, maps, or nested pointers

Source references: 2
What we found

The documentation presents the pattern for pointers, slices, and maps and says mutations will not affect the cache, but the example only performs copy := *u. That copies the top-level struct while slices, maps, and nested pointers still share their underlying data.

Why this matters

A caller modifying a nested mutable field can still change the shared cached object, causing cross-request data corruption or races—the problem this configuration claims to prevent.

The guide presents this pattern as required for mutable pointers, slices, and maps and says caller mutations will not affect the cache, but `copy := *u` is only a shallow copy. If User contains slices, maps, or nested pointers, their backing data remains shared, so concurrent mutation can still race or corrupt cached state. It is adequate only when relevant fields are value-only. Users can ask for an explicit shallow-copy warning, a deep-copy example, and race tests using types with reference fields.

references/production-patterns.md:151In the instructionsOpen original file
## Copy-on-Read / Copy-on-WriteRequired when cached values are mutable (pointers, slices, maps):```gocache := hot.NewHotCache[string, *User](hot.WTinyLFU, 10_000).    WithTTL(5 * time.Minute).    WithCopyOnRead(func(u *User) *User {        copy := *u        return &copy    }).    WithCopyOnWrite(func(u *User) *User {        copy := *u        return &copy    }).    WithJanitor().    Build()defer cache.StopJanitor()```
Show 1 other places
references/production-patterns.md:171In the instructionsOpen original file
- **CopyOnRead** — clones at retrieval: callers get independent copies, mutations don't affect cache- **CopyOnWrite** — clones at storage: cache holds a snapshot, external mutations to the original don't corrupt cached value- Use both when callers read and write concurrently. Use only one when the mutation direction is known.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

The installation command uses -u and may upgrade existing project dependencies

Source references: 2
What we found

The recommended command is go get -u github.com/samber/hot rather than a pinned version. The -u flag asks Go to resolve newer module versions and can update the project's go.mod and go.sum rather than merely trying the library in memory.

Why this matters

The project may receive direct or indirect dependency versions not separately reviewed for the task, causing build changes, compatibility problems, or added supply-chain exposure. Those changes persist in the repository workspace.

This is an active installation recommendation, not a test or warning. Running `go get -u` modifies the current Go module's dependency files and may select newer related module versions, creating compatibility or supply-chain changes beyond merely trying the cache. The command does not execute just because it appears in the document. Users can ask for a pinned version without `-u` and review go.mod/go.sum changes in an isolated branch.

SKILL.md:40In the instructionsOpen original file
```bashgo get -u github.com/samber/hot```
Show 1 other places
SKILL.md:34In the instructionsOpen original file
This skill is not exhaustive — refer to library documentation and code examples for more information:- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).- Context7 remains a fallback for docs not indexed on pkg.go.dev.```bashgo get -u github.com/samber/hot```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Declared tool permissions are substantially broader than cache configuration requires

Source references: 2
What we found

The Skill requests Edit, Write, all go, git, and golangci-lint commands, plus agent and network-fetch capabilities. In particular, Bash(git:*) is not limited to read-only operations, while the documented cache workflow does not require changing Git history, branches, or remotes.

Why this matters

If the host enforces this field as a permission grant, an agent driven by the Skill could alter project files, dependencies, and Git state or access the network. Mistakes or later untrusted content would therefore have a larger impact. The evidence shows requested capability, not that such an action occurred.

If the host enforces allowed-tools, this declaration permits file writes, unrestricted go/git/golangci-lint subcommands, agents, and network fetching. git:* includes operations that could change branches, history, or remotes, while the stated purpose is Go cache selection and integration and provides no specific workflow requiring broad Git authority. Impact depends on host enforcement and later generated commands. Users can ask the author to narrow permissions and disable writes, agents, network access, and Git mutations in the host.

SKILL.md:18In the instructionsOpen original file
    skill-library-version: "0.13.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
Show 1 other places
SKILL.md:3In the instructionsOpen original file
name: golang-samber-hotdescription: "In-memory caching in Golang using samber/hot — eviction algorithms (LRU, LFU, TinyLFU, W-TinyLFU, S3FIFO, ARC, TwoQueue, SIEVE, FIFO), TTL, cache loaders, sharding, stale-while-revalidate, missing key caching, and Prometheus metrics. Apply when using or adopting samber/hot, when the codebase imports github.com/samber/hot, or when the project repeatedly loads the same medium-to-low cardinality resources at high frequency and needs to reduce latency or backend pressure."user-invocable: true
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill guides an agent in adding and configuring the samber/hot in-memory cache in Go projects, including TTLs, loaders, eviction algorithms, and monitoring.

View source
SKILL.md:25In the instructionsOpen original file
# Using samber/hot for In-Memory Caching in GoGeneric, type-safe in-memory caching library for Go 1.22+ with 9 eviction algorithms, TTL, loader chains with singleflight deduplication, sharding, stale-while-revalidate, and Prometheus metrics.

On a cache miss, configured loaders query a backend such as a database; concurrent requests for the same missing key share one invocation. This is an explicit read behavior, while the accessible data depends on the loader supplied by the user's project.

View source
SKILL.md:85In the instructionsOpen original file
Loaders fetch missing keys automatically with singleflight deduplication — concurrent `Get()` calls for the same missing key share one loader invocation:```gocache := hot.NewHotCache[int, *User](hot.WTinyLFU, 10_000).    WithTTL(5 * time.Minute).    WithLoaders(func(ids []int) (map[int]*User, error) {        return db.GetUsersByIDs(ctx, ids) // batch query    }).

The production pattern can return a stale value after its TTL while refreshing it in the background; the example retains that value on refresh failure, but only until hard expiry.

View source
references/production-patterns.md:31In the instructionsOpen original file
cache := hot.NewHotCache[string, *Config](hot.WTinyLFU, 1_000).    WithTTL(5 * time.Minute).                              // stale after 5min    WithRevalidation(1 * time.Minute, refreshLoader).       // hard-expire after 6min total    WithRevalidationErrorPolicy(hot.KeepOnError).           // keep stale value if refresh fails    WithJitter(0.1, 30*time.Second).                        // spread expirations    WithJanitor().    Build()defer cache.StopJanitor()```
Start here · InstructionsSKILL.md
golang-samber-hot
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/algorithm-guide.mdFull text included
  • references/api-reference.mdFull text included
  • references/production-patterns.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/algorithm-guide.mdSupporting file
  • references/api-reference.mdSupporting file
  • references/production-patterns.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🔥"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:31In the instructionsOpen original file
- [pkg.go.dev/github.com/samber/hot](https://pkg.go.dev/github.com/samber/hot)- [github.com/samber/hot](https://github.com/samber/hot)
SKILL.md:32In the instructionsOpen original file
- [pkg.go.dev/github.com/samber/hot](https://pkg.go.dev/github.com/samber/hot)- [github.com/samber/hot](https://github.com/samber/hot)
Run commands
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "0.13.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
SKILL.md:40In the instructionsOpen original file
```bashgo get -u github.com/samber/hot
Change files
references/production-patterns.md:63In the instructionsOpen original file
        h := fnv.New64a()        h.Write([]byte(key))        return h.Sum64()
Lines read
945
File checksum (to compare versions)
ade54f4eef7f01fb666ced2a39a2a5603154e56d6c7f75b7999a4e78aa0893e1