Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Samber Mo Skill Security Audit

What the author says it does (original text)

Monadic types for Golang using samber/mo — Option, Result, Either, Future, IO, Task, and State types for type-safe nullable values, error handling, and functional composition with pipeline sub-packages. Apply when using or adopting samber/mo, when the codebase imports `github.com/samber/mo`, or when considering functional programming patterns as a safety design for Golang. Not for nil-safety and z

Independent security check

Security risks found

Files checked
8
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The instruction to open a public issue may disclose private project details and speak for the user

Source references: 1
What we found

The body directly says to open an issue in samber/mo's public GitHub repository, without requiring user approval or redaction of code, paths, configuration, logs, or business data.

Why this matters

If followed, a bug report could publicly expose sensitive project details through the user's account and create an unapproved external communication with a lasting public record. The text does not show that an issue was actually created.

This is a direct instruction in the live skill text, not an example or warning: when a library problem is encountered, it says to open an issue in a public GitHub repository. Doing so publishes content externally on the user's behalf and could expose private snippets, logs, paths, or business context; the text requires neither consent nor redaction. Users can restrict the skill to drafting an issue and require approval of its content, destination, and redaction before publication.

SKILL.md:273In the instructionsOpen original file
If you encounter a bug or unexpected behavior in samber/mo, open an issue at <https://github.com/samber/mo/issues>.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The permission declaration allows arbitrary Git and broad Go commands beyond a pure API guide's needs

Source references: 2
What we found

`Bash(git:*)` can cover pushes, forced resets, cleans, and branch deletion. `Bash(go:*)` can run project code or generators and alter persistent Go configuration. The body provides no per-action confirmation or target restrictions for these broad permissions.

Why this matters

If the Skill, external documentation, or agent judgment is manipulated, a repository could be rewritten, uncommitted files could be lost, code could be pushed remotely, or project code could execute locally. The permission alone does not show that any such action occurred.

The stated purpose is guidance on samber/mo types and composition, while the tool declaration permits unrestricted `git:*` and `go:*` subcommands. This does not prove any command will run, but if the agent invokes them, the scope can include repository changes, project-code execution, or Go configuration changes beyond documentation lookup. Users can ask the author to narrow permissions to read-only commands and require confirmation before writes, project execution, or remote Git operations.

SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.16.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
Show 1 other places
SKILL.md:3In the instructionsOpen original file
name: golang-samber-modescription: "Monadic types for Golang using samber/mo — Option, Result, Either, Future, IO, Task, and State types for type-safe nullable values, error handling, and functional composition with pipeline sub-packages. Apply when using or adopting samber/mo, when the codebase imports `github.com/samber/mo`, or when considering functional programming patterns as a safety design for Golang. Not for nil-safety and zero-value design without this library (→ See `samber/cc-skills-golang@golang-safety` skill), nor for native error wrapping with fmt.Errorf, errors.Is and errors.As (→ See `samber/cc-skills-golang@golang-error-handling` skill)."user-invocable: true
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a Go programming guide centered on samber/mo's Option, Result, Either, and pipeline types; its declared file scope is Go source files.

View source
SKILL.md:2In the instructionsOpen original file
---name: golang-samber-modescription: "Monadic types for Golang using samber/mo — Option, Result, Either, Future, IO, Task, and State types for type-safe nullable values, error handling, and functional composition with pipeline sub-packages. Apply when using or adopting samber/mo, when the codebase imports `github.com/samber/mo`, or when considering functional programming patterns as a safety design for Golang. Not for nil-safety and zero-value design without this library (→ See `samber/cc-skills-golang@golang-safety` skill), nor for native error wrapping with fmt.Errorf, errors.Is and errors.As (→ See `samber/cc-skills-golang@golang-error-handling` skill)."user-invocable: true
SKILL.md:19In the instructionsOpen original file
allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:  - "**/*.go"---

The documentation shows adding the third-party dependency with `go get`. If actually executed, it downloads modules and normally changes the project's go.mod/go.sum. This is normal when adopting the library, but should not happen automatically when the user only asks about usage.

View source
SKILL.md:42In the instructionsOpen original file
```bashgo get github.com/samber/mo```

The references contain code that reads a local configuration file and contacts an example API, but these appear in explanatory Go code blocks rather than as immediate audit-time or runtime commands.

View source
references/advanced-types.md:116In the instructionsOpen original file
```goio := mo.NewIOEither(func() mo.Either[error, string] {    data, err := os.ReadFile("config.yaml")    if err != nil {        return mo.Left[error, string](err)    }    return mo.Right[error, string](string(data))})
references/advanced-types.md:184In the instructionsOpen original file
```gote := mo.NewTaskEither(func() *mo.Future[string] {    return mo.NewFuture(func(resolve func(string), reject func(error)) {        resp, err := http.Get("https://api.example.com/data")        if err != nil {            reject(err)            return        }        defer resp.Body.Close()        body, err := io.ReadAll(resp.Body)

The Skill explicitly warns that MustGet panics on absent or error values and recommends fallbacks, limiting MustGet to mo.Do blocks or cases where presence is certain.

View source
SKILL.md:264In the instructionsOpen original file
1. **Prefer `OrElse` over `MustGet`** — `MustGet` panics on absent/error values; use it only inside `mo.Do` blocks where panics are caught, or when you are certain the value exists2. **Use `TupleToResult` at API boundaries** — convert Go's `(T, error)` to `Result[T]` at the boundary, then chain with `Map`/`FlatMap` inside your domain logic
Start here · InstructionsSKILL.md
golang-samber-mo
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.

File reference map

References: 9
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records8 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/advanced-types.mdFull text included
  • references/either.mdFull text included
  • references/monads-guide.mdFull text included
  • references/option.mdFull text included
  • references/pipelines.mdFull text included
  • references/result.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/advanced-types.mdSupporting file
  • references/either.mdSupporting file
  • references/monads-guide.mdSupporting file
  • references/option.mdSupporting file
  • references/pipelines.mdSupporting file
  • references/result.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🎭"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:33In the instructionsOpen original file
- [pkg.go.dev/github.com/samber/mo](https://pkg.go.dev/github.com/samber/mo)- [github.com/samber/mo](https://github.com/samber/mo)
SKILL.md:34In the instructionsOpen original file
- [pkg.go.dev/github.com/samber/mo](https://pkg.go.dev/github.com/samber/mo)- [github.com/samber/mo](https://github.com/samber/mo)
Run commands
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.16.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
SKILL.md:42In the instructionsOpen original file
```bashgo get github.com/samber/mo
Read files
SKILL.md:94In the instructionsOpen original file
// Wrap Go's (value, error) patternresult := mo.TupleToResult(os.ReadFile("config.yaml"))
SKILL.md:113In the instructionsOpen original file
parsed := result.Pipe2(    mo.TupleToResult(os.ReadFile("config.yaml")),    result.Map(func(data []byte) Config { return parseConfig(data) }),
evals/evals.json:20In the instructionsOpen original file
    "description": "Tests whether the model knows when to use Result[T] vs (T, error)",    "prompt": "I'm writing a Go function that reads a config file, parses YAML, validates the config, and returns the result. The function is part of a public API package. Should I use samber/mo Result[T] as the return type?",    "trap": "Without the skill, the model either always uses Result or always uses (T, error). The correct answer is: use (T, error) at public API boundaries for Go idiom compliance, but use Result internally for chaining.",
Lines read
1,721
File checksum (to compare versions)
c79d5a49f4a55f02aca39745df49eb15a639c3844889235526476daa7400df6f