Skip to content
skillsafebeta
← Report library
Purpose / Writing

Golang Stretchr Testify Skill Security Audit

What the author says it does (original text)

Comprehensive guide to stretchr/testify for Golang testing. Covers assert, require, mock, and suite packages in depth. Use when writing tests with testify, creating mocks, setting up test suites, or choosing between assert and require. Covers testify assertions, mock expectations, argument matchers, call verification, suite lifecycle, and advanced patterns like Eventually, JSONEq, and custom match

Independent security check

Security risks found

Files checked
3
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

An unpinned third-party Go executable may be installed automatically

Source references: 2
What we found

The manifest requests `github.com/cweill/gotests/...@latest`. The resolved code can change over time, so this review cannot identify the exact future version that would run. The Testify guide itself does not demonstrate a need for gotests.

Why this matters

If the host automatically provisions dependencies, a future compromised or otherwise unsafe upstream release could execute with access to the workspace and Go build environment. The supplied evidence does not show that the current release is malicious.

When installation occurs, the manifest fetches `github.com/cweill/gotests/...@latest`, so the resolved code can change over time. This creates supply-chain and reproducibility risk, although it does not show that the dependency is malicious. The stated purpose is Testify testing guidance, and the visible text does not explain why gotests must be installed. Users can require a reviewed pinned version and integrity information, or disable automatic installation.

SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go        - gotests    install:      - kind: go        package: github.com/cweill/gotests/...@latest        bins: [gotests]    skill-library-version: "1.11.1"
Show 1 other places
SKILL.md:3In the instructionsOpen original file
name: golang-stretchr-testifydescription: "Comprehensive guide to stretchr/testify for Golang testing. Covers assert, require, mock, and suite packages in depth. Use when writing tests with testify, creating mocks, setting up test suites, or choosing between assert and require. Covers testify assertions, mock expectations, argument matchers, call verification, suite lifecycle, and advanced patterns like Eventually, JSONEq, and custom matchers. Apply when the codebase imports github.com/stretchr/testify."user-invocable: true
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

Declared tool access is broader than the apparent needs of a Testify guide

Source references: 2
What we found

Besides reading/writing Go files and running test-related tools, the Skill declares every command matching `git:*`, web retrieval, and Agent access. Its instructions do not present a workflow requiring changes to Git remotes, branches, or history.

Why this matters

If the host treats this field as an effective capability grant, a misdirected agent could push, delete branches, or make other Git state changes, and could retrieve unreviewed network content. The declaration alone is not evidence that any such operation will occur.

The declaration permits all matching `git:*` commands and includes Agent, WebFetch, and file-writing capabilities. If the host enforces this grant, invocation could access the network, alter a repository, or delegate work. The visible write/review modes do not define a specific need or boundary for those capabilities. This does not show they will be used or that a remote will be changed, but it enlarges the impact surface. Users can require a minimal tool list and block Git mutations, network access, and delegation unless approved per use.

SKILL.md:22In the instructionsOpen original file
    skill-library-version: "1.11.1"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(gotests:*) AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
Show 1 other places
SKILL.md:29In the instructionsOpen original file
**Modes:**- **Write mode** — adding new tests or mocks to a codebase.- **Review mode** — auditing existing test code for testify misuse.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

The Skill incorrectly says Testify Equal compares pointer addresses only

Source references: 3
What we found

The guide says `is.Equal(ptr1, ptr2)` compares addresses, although Testify's `Equal` normally uses deep-equality semantics; distinct pointers to equal values can compare equal. The evaluation file explicitly requires the model to repeat the claim, making the misinformation systematic.

Why this matters

A user could misdiagnose a failure actually caused by differing fields, types, or another issue, then unnecessarily dereference pointers or switch to an assertion that checks only exported fields, changing or weakening the intended test.

This is active technical guidance, not a warning or negative example: the guide says `Equal` compares pointer addresses and advises dereferencing or another assertion, while the evaluation explicitly rewards repeating that claim. Because Testify `Equal` uses deep-equality semantics, distinct pointers to equal values can normally compare equal. The instruction could therefore mislead diagnosis or prompt unnecessary changes to valid tests. Users can ask the author to verify and correct the rule against the targeted Testify version's implementation or tests.

SKILL.md:192In the instructionsOpen original file
- **Missing `suite.Run()`** — without the launcher function, zero tests execute silently- **Comparing pointers** — `is.Equal(ptr1, ptr2)` compares addresses. Dereference or use `EqualExportedValues`
Show 2 other places
evals/evals.json:113In the instructionsOpen original file
    "name": "pointer-comparison-trap",    "description": "Tests awareness that is.Equal(ptr1, ptr2) compares addresses, not values",    "prompt": "I have two *User pointers pointing to different structs with the same field values. My test `assert.Equal(t, user1, user2)` is failing. Both users have Name='Alice' and Age=30. What's wrong?",    "trap": "Model may suggest various debugging approaches without identifying the core issue: Equal on pointers compares addresses",    "assertions": [      {"id": "9.1", "text": "Identifies that assert.Equal on pointers compares memory addresses, not struct values"},      {"id": "9.2", "text": "Recommends dereferencing the pointers (e.g., assert.Equal(t, *user1, *user2)) or using EqualExportedValues"},      {"id": "9.3", "text": "Mentions EqualExportedValues as an alternative for comparing only exported fields"}    ]
evals/evals.json:112In the instructionsOpen original file
    "id": 9,    "name": "pointer-comparison-trap",    "description": "Tests awareness that is.Equal(ptr1, ptr2) compares addresses, not values",    "prompt": "I have two *User pointers pointing to different structs with the same field values. My test `assert.Equal(t, user1, user2)` is failing. Both users have Name='Alice' and Age=30. What's wrong?",    "trap": "Model may suggest various debugging approaches without identifying the core issue: Equal on pointers compares addresses",    "assertions": [      {"id": "9.1", "text": "Identifies that assert.Equal on pointers compares memory addresses, not struct values"},      {"id": "9.2", "text": "Recommends dereferencing the pointers (e.g., assert.Equal(t, *user1, *user2)) or using EqualExportedValues"},      {"id": "9.3", "text": "Mentions EqualExportedValues as an alternative for comparing only exported fields"}    ]
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill is a Testify usage guide with “write” and “review” modes. In write mode, it may add tests or mocks to the user's codebase.

View source
SKILL.md:29In the instructionsOpen original file
**Modes:**- **Write mode** — adding new tests or mocks to a codebase.- **Review mode** — auditing existing test code for testify misuse.

It directs the agent to external Go documentation tools, preferring another Skill and using Context7 as a fallback, so some answers may depend on externally retrieved content.

View source
SKILL.md:38In the instructionsOpen original file
This skill is not exhaustive — refer to library documentation and code examples for more information:- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).- Context7 remains a fallback for docs not indexed on pkg.go.dev.
Start here · InstructionsSKILL.md
golang-stretchr-testify
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/mock.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/mock.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "✅"    homepage: https://github.com/samber/cc-skills-golang    requires:
evals/evals.json:75In the instructionsOpen original file
    "description": "Tests knowledge of chaining .Once() calls to return different values per call for retry testing",    "prompt": "I need to test that my Go HTTP client retries on failure. The client calls Fetcher.Fetch(url string) ([]byte, error). First call should return a timeout error, second call should succeed with some data. How do I set up this mock?",    "trap": "Model may not know how to return different values per call and instead use a single Return() that applies to all calls",
Run commands
SKILL.md:22In the instructionsOpen original file
    skill-library-version: "1.11.1"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(gotests:*) AskUserQuestion Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
Lines read
451
File checksum (to compare versions)
2cdfe3151a8172f637f9ad646202b738e382352f705f573ace9f082b7c5ad2e8