Skip to content
skillsafebeta
← Report library
Purpose / Other

Golang Spf13 Cobra Skill Security Audit

What the author says it does (original text)

Golang CLI command tree library using spf13/cobra — cobra.Command, RunE vs Run, PersistentPreRunE hook chain, Args validators (NoArgs, ExactArgs, MatchAll, custom), persistent vs local flags, command groups, ValidArgsFunction, RegisterFlagCompletionFunc, ShellCompDirective, usage/help template customization, man-page and markdown doc generation, and testing with SetArgs/SetOut/SetErr. Apply when u

Independent security check

Security risks found

Files checked
7
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Mutable `@latest` installs are followed by execution of a downloaded scaffolding tool

Source references: 3
What we found

The Skill recommends fetching the latest Cobra and cobra-cli releases and shows immediately invoking the scaffolder through `go tool`. `latest` is not pinned to a reviewed version and can resolve differently over time.

Why this matters

Execution contacts dependency sources and changes Go module or tool configuration; the scaffolder also creates or modifies project files. A malicious, compromised, or incompatible newest release would directly affect the user.

These are documentation examples, not automatic installer code, but they do recommend fetching unpinned `@latest` versions and then running `go tool cobra-cli` to generate or modify project files. If followed, the downloaded executable can change over time and the scaffolder writes into the current project. Users can ask for an audited pinned version and preview generated files in an isolated directory before merging them. The Cobra dependency is also unpinned, while the shown download-then-scaffold sequence specifically involves cobra-cli.

SKILL.md:47In the instructionsOpen original file
```bashgo get github.com/spf13/cobra@latest```
Show 2 other places
references/generators.md:63In the instructionsOpen original file
```bashgo get -tool github.com/spf13/cobra-cli@latest# Initialize a new cobra projectgo tool cobra-cli init myapp# Add a subcommandgo tool cobra-cli add servego tool cobra-cli add migrate
references/generators.md:61In the instructionsOpen original file
`cobra-cli` generates command files and wires them into your project:```bashgo get -tool github.com/spf13/cobra-cli@latest# Initialize a new cobra projectgo tool cobra-cli init myapp# Add a subcommandgo tool cobra-cli add servego tool cobra-cli add migrate
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

The completion-install example directly overwrites `_myapp` at a resolved shell path

Source references: 1
What we found

The example redirects generated output to `${fpath[1]}/_myapp` without first checking the resolved target, confirming ownership of the directory, or preserving an existing file.

Why this matters

An existing completion file at that path would be truncated and replaced. Unexpected path resolution could also write the content somewhere the user did not intend.

This is an explicitly labeled zsh installation example and does not run automatically. If copied, however, `>` creates or truncates `_myapp` when `${fpath[1]}` resolves to a writable directory. An existing completion file at that path would be overwritten without a prompt, potentially changing current shell completion behavior. Users can resolve and inspect the target first, back up any existing file, or ask for a no-clobber installation example.

references/completions.md:26In the instructionsOpen original file
# Install (example for zsh):myapp completion zsh > "${fpath[1]}/_myapp"```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The tool allowance includes arbitrary Git commands not required by the documented workflow

Source references: 2
What we found

The declaration permits `Bash(git:*)`, network retrieval, agent invocation, and file editing. Go and editing can support Cobra development, but no visible step requires arbitrary Git commands, whose scope can include commits, branches, and remote operations.

Why this matters

If the agent is influenced by faulty context or instructions inside a project, these permissions increase its ability to alter version history, stage user files, or interact with a remote repository. The evidence establishes capability, not that such actions occurred.

The declaration permits every matching Git command alongside file writes, web fetching, and agent calls. The stated workflows build, extend, or review Cobra command trees but do not identify a concrete need for broad Git actions such as commits, pushes, or branch deletion. The risk arises only if the host executes a model-generated Git command; this is not evidence that any repository was changed. Users can ask the author to allow only read-only Git subcommands or disable Git mutations and remote operations at runtime.

SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.10.2"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
Show 1 other places
SKILL.md:27In the instructionsOpen original file
- **Build** — creating a new CLI from scratch: follow command tree setup, hook wiring, and flag sections sequentially.- **Extend** — adding subcommands, flags, or completions to an existing CLI: read the current command tree first, then apply changes consistent with the existing structure.- **Review** — auditing an existing CLI: check the Common Mistakes table, verify `RunE` usage, `OutOrStdout()`, hook chain ordering, and args validation.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a Cobra development guide for Go projects. It directs the agent to build, extend, or review command trees and may therefore modify existing Go source files.

View source
SKILL.md:27In the instructionsOpen original file
- **Build** — creating a new CLI from scratch: follow command tree setup, hook wiring, and flag sections sequentially.- **Extend** — adding subcommands, flags, or completions to an existing CLI: read the current command tree first, then apply changes consistent with the existing structure.- **Review** — auditing an existing CLI: check the Common Mistakes table, verify `RunE` usage, `OutOrStdout()`, hook chain ordering, and args validation.

The metadata declares no automatic installation, but the body supplies commands for downloading a dependency and a scaffolding tool. Network access and project changes therefore depend on whether the agent executes those examples.

View source
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []    skill-library-version: "1.10.2"
SKILL.md:47In the instructionsOpen original file
```bashgo get github.com/spf13/cobra@latest```
references/generators.md:63In the instructionsOpen original file
```bashgo get -tool github.com/spf13/cobra-cli@latest# Initialize a new cobra projectgo tool cobra-cli init myapp# Add a subcommandgo tool cobra-cli add servego tool cobra-cli add migrate

The supplied content consists mainly of documentation, evaluation cases, and example snippets. It contains no visible bundled executable script and no visible implementation that reads credentials or uploads data. This absence does not establish that code later generated or modified by the Skill will be safe.

View source
SKILL.md:31In the instructionsOpen original file
# Using spf13/cobra for CLI command trees in GoCobra is the de facto standard for Go CLI applications. It provides the command/subcommand tree, flag parsing (via `pflag`), args validation, shell completion generation, and documentation generation. It does **not** handle configuration layering — that's viper's job.
Start here · InstructionsSKILL.md
golang-spf13-cobra
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.

File reference map

References: 5
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records7 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/commands-and-args.mdFull text included
  • references/completions.mdFull text included
  • references/flags.mdFull text included
  • references/generators.mdFull text included
  • references/testing.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/commands-and-args.mdSupporting file
  • references/completions.mdSupporting file
  • references/flags.mdSupporting file
  • references/generators.mdSupporting file
  • references/testing.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🐍"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:37In the instructionsOpen original file
- [pkg.go.dev/github.com/spf13/cobra](https://pkg.go.dev/github.com/spf13/cobra)- [github.com/spf13/cobra](https://github.com/spf13/cobra)
SKILL.md:38In the instructionsOpen original file
- [pkg.go.dev/github.com/spf13/cobra](https://pkg.go.dev/github.com/spf13/cobra)- [github.com/spf13/cobra](https://github.com/spf13/cobra)- [cobra.dev](https://cobra.dev)
Run commands
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.10.2"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
SKILL.md:47In the instructionsOpen original file
```bashgo get github.com/spf13/cobra@latest
references/completions.md:3In the instructionsOpen original file
Cobra generates shell completion scripts for bash, zsh, fish, and PowerShell automatically. Subcommand names and flag names are completed for free. You add completions for flag values and positional arguments.
Read files
evals/evals.json:259In the instructionsOpen original file
        "id": "11.5",        "text": "Does NOT say cobra reads config files or viper defines subcommands"      }
references/testing.md:101In the instructionsOpen original file
    }    want, _ := os.ReadFile(golden)    assert.Equal(t, string(want), buf.String())
Change files
references/testing.md:99In the instructionsOpen original file
    if *update {  // -update flag        os.WriteFile(golden, buf.Bytes(), 0644)    }
Lines read
1,352
File checksum (to compare versions)
fb04080a28edfc077898e3cc756b5247ed8c9c22b58519dace7f69f202817101