Skip to content
skillsafebeta
← Report library
Purpose / Other

Golang Samber Lo Skill Security Audit

What the author says it does (original text)

Functional programming helpers for Golang using samber/lo — 500+ type-safe generic functions for slices, maps, channels, strings, math, tuples, and concurrency (Map, Filter, Reduce, GroupBy, Chunk, Flatten, Find, Uniq, etc.). Core immutable package (lo), concurrent variants (lo/parallel aka lop), in-place mutations (lo/mutable aka lom), lazy iterators (lo/it aka loi for Go 1.23+), and experimental

Independent security check

Security risks found

Files checked
5
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Low risk

The installation command downloads third-party code and changes project dependency state

Source references: 2
What we found

The Skill directly recommends `go get github.com/samber/lo`. This is normal Go dependency installation, but it contacts module sources and normally changes go.mod/go.sum rather than merely supplying offline documentation.

Why this matters

After execution, project builds will trust and compile the resolved version's third-party source. An unreviewed version change can also affect reproducibility or introduce supply-chain exposure. No exact version is pinned in the supplied command, and the material cannot establish the downloaded code's safety.

Legitimate use of this code

This is a standard Go module-add command in an explicit installation section and matches the Skill's stated purpose; it is not a hidden script or automatic install hook. Only if a user or agent runs it would it fetch a third-party module and potentially update go.mod/go.sum. The source does not show that it was executed. Users can require version confirmation and dependency-diff review, and restrict unapproved network access or file writes.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:52In the instructionsOpen original file
## Installation```bashgo get github.com/samber/lo```
Show 1 other places
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []    skill-library-version: "1.53.0"
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The Skill receives broad Git command access unrelated to its Go-helper purpose

Source references: 3
What we found

The allowed tools include unrestricted `Bash(git:*)`. The stated purpose is Go collection transformations and samber/lo adoption, and no workflow shown requires pushing, resetting, cleaning, or deleting branches.

Why this matters

If the agent misuses this access while the Skill is active, or is induced by project content to do so, it could rewrite history, delete uncommitted work, or push remotely where credentials and remote configuration permit. The supplied material does not show that any such action occurred.

The stated purpose is Go collection transformation with samber/lo, yet the tool grant permits any git subcommand. If invoked, it could push code, hard-reset or clean files, or delete branches, affecting user files and remote repositories; the supplied workflow does not explain why this access is needed or constrain it. Users can ask the author to remove Git access or allow only specifically required read-only subcommands.

SKILL.md:2In the instructionsOpen original file
---name: golang-samber-lodescription: "Functional programming helpers for Golang using samber/lo — 500+ type-safe generic functions for slices, maps, channels, strings, math, tuples, and concurrency (Map, Filter, Reduce, GroupBy, Chunk, Flatten, Find, Uniq, etc.). Core immutable package (lo), concurrent variants (lo/parallel aka lop), in-place mutations (lo/mutable aka lom), lazy iterators (lo/it aka loi for Go 1.23+), and experimental SIMD (lo/exp/simd). Apply when using or adopting samber/lo, when the codebase imports github.com/samber/lo, or when implementing functional-style data transformations in Go. Not for streaming pipelines (→ See `samber/cc-skills-golang@golang-samber-ro` skill)."user-invocable: true
Show 2 other places
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.53.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) mcp__context7__resolve-library-id mcp__context7__query-docs AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
SKILL.md:3In the instructionsOpen original file
name: golang-samber-lodescription: "Functional programming helpers for Golang using samber/lo — 500+ type-safe generic functions for slices, maps, channels, strings, math, tuples, and concurrency (Map, Filter, Reduce, GroupBy, Chunk, Flatten, Find, Uniq, etc.). Core immutable package (lo), concurrent variants (lo/parallel aka lop), in-place mutations (lo/mutable aka lom), lazy iterators (lo/it aka loi for Go 1.23+), and experimental SIMD (lo/exp/simd). Apply when using or adopting samber/lo, when the codebase imports github.com/samber/lo, or when implementing functional-style data transformations in Go. Not for streaming pipelines (→ See `samber/cc-skills-golang@golang-samber-ro` skill)."user-invocable: true
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a Go programming guide for samber/lo. It directs the agent to choose among the standard library, immutable transforms, parallel processing, in-place mutation, lazy iteration, and experimental SIMD; its main behavior is advising on and generating or modifying Go code.

View source
SKILL.md:23In the instructionsOpen original file
**Persona:** You are a Go engineer who prefers declarative collection transforms over manual loops. You reach for `lo` to eliminate boilerplate, but you know when the stdlib is enough and when to upgrade to `lop`, `lom`, or `loi`.# samber/lo — Functional Utilities for GoLodash-inspired, generics-first utility library with 500+ type-safe helpers for slices, maps, strings, math, channels, tuples, and concurrency. Zero external dependencies. Immutable by default.

When adopting the library, the Skill's installation step downloads a dependency from a GitHub module path and updates the current Go project's dependency records; the manifest declares no automatic install hooks.

View source
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []    skill-library-version: "1.53.0"
SKILL.md:52In the instructionsOpen original file
## Installation```bashgo get github.com/samber/lo```

The Skill explicitly states that the mutable package changes slices in place, can lose the original data, and is unsafe for concurrent access, and it limits its use to profiling-confirmed cases. This reduces the chance that the examples are mistaken for safe default transforms.

View source
references/package-guide.md:88In the instructionsOpen original file
**Characteristics:**- Modifies the input slice — callers must expect side effects- `lom.Filter` shortens the slice (removes non-matching elements in-place)- `lom.Map` transforms elements in-place (preserves length)- Uses Fisher-Yates for `Shuffle`- Not safe for concurrent access to the source slice**Use when:**- `go tool pprof -alloc_objects` confirms allocation pressure from `lo.Filter`/`lo.Map`- Working with very large slices where GC pressure is measurable- You explicitly want to modify the source and won't need the original
references/advanced-patterns.md:131In the instructionsOpen original file
// After — zero allocations, modifies in-placeevents = lom.Filter(events, isValid)// Warning: 'events' is now modified. Original data is lost.```

The Skill sets boundaries around risky or easily misused APIs: panic-producing Must helpers should not be used in production request paths, and experimental SIMD should be benchmarked and version-pinned.

View source
SKILL.md:142In the instructionsOpen original file
| Assuming `lo.Filter` modifies the input | `lo` is immutable by default — it returns a new slice | Use `lom.Filter` if you explicitly need in-place mutation || Using `lo.Must` in production code paths | `Must` panics on error — fine in tests and init, dangerous in request handlers | Use the non-Must variant and handle the error || Chaining many eager transforms on large data | Each step allocates an intermediate slice | Use `loi` (lazy iterators) to avoid intermediate allocations |
references/package-guide.md:150In the instructionsOpen original file
## `lo/exp/simd` — Experimental SIMDSIMD (Single Instruction Multiple Data) optimized operations for numeric types on amd64.**Use when:** Bulk numeric operations after benchmarking confirms the bottleneck. Very specialized.**Warning:** This package is experimental and not covered by semver stability guarantees, so its API may break between minor versions. Do not use in production without version pinning.
Start here · InstructionsSKILL.md
golang-samber-lo
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/advanced-patterns.mdFull text included
  • references/api-reference.mdFull text included
  • references/package-guide.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/advanced-patterns.mdSupporting file
  • references/api-reference.mdSupporting file
  • references/package-guide.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🧰"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:31In the instructionsOpen original file
- [github.com/samber/lo](https://github.com/samber/lo)- [lo.samber.dev](https://lo.samber.dev)
SKILL.md:32In the instructionsOpen original file
- [github.com/samber/lo](https://github.com/samber/lo)- [lo.samber.dev](https://lo.samber.dev)- [pkg.go.dev/github.com/samber/lo](https://pkg.go.dev/github.com/samber/lo)
Run commands
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.53.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) mcp__context7__resolve-library-id mcp__context7__query-docs AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
SKILL.md:54In the instructionsOpen original file
```bashgo get github.com/samber/lo
Lines read
1,139
File checksum (to compare versions)
e0867665ea0411455c73170766e496d46cc80d4cfd9713d7bfb0dbec3d802a73