Skip to content
skillsafebeta
← Report library
Purpose / Writing

Golang Structs Interfaces Skill Security Audit

What the author says it does (original text)

Golang struct and interface design patterns — composition, embedding, type assertions, type switches, interface segregation, dependency injection via interfaces, struct field tags, and pointer vs value receivers. Use this skill when designing Go types, defining or implementing interfaces, embedding structs or interfaces, writing type assertions or type switches, adding struct field tags for JSON/Y

Independent security check

Security risks found

Files checked
4
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Arbitrary git subcommands are allowed beyond the Go design task

Source references: 3
What we found

The tool declaration permits `Bash(git:*)` without limiting it to read-only commands, while the stated task is Go type design and its diagnostic steps only require Go tooling.

Why this matters

If the Skill is misapplied, an agent could stage or commit user changes, switch branches, rewrite history, or—where credentials and network access exist—push to a remote. The permission declaration alone does not show that any such action occurs.

The skill is for Go type and interface design, yet it permits every `git` subcommand rather than read-only inspection. If the host enforces this declaration and the model invokes such a command, it could alter history, delete branches, or push to remotes, affecting the user's repository or remote account. Those powers are not necessary for the stated design tasks. The user can ask the author to remove this permission or allow only specific read-only git commands.

SKILL.md:3In the instructionsOpen original file
name: golang-structs-interfacesdescription: 'Golang struct and interface design patterns — composition, embedding, type assertions, type switches, interface segregation, dependency injection via interfaces, struct field tags, and pointer vs value receivers. Use this skill when designing Go types, defining or implementing interfaces, embedding structs or interfaces, writing type assertions or type switches, adding struct field tags for JSON/YAML/DB serialization, or choosing between pointer and value receivers. Also use when the user asks about "accept interfaces, return structs", compile-time interface checks, or composing small interfaces into larger ones.'user-invocable: true
Show 2 other places
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
references/struct-fields.md:71In the instructionsOpen original file
**Diagnose:** 1- `go vet ./...` — `copylocks` reports every value copy of a lock-bearing struct 2- `go test -race ./...` — surfaces the data races a silent copy introduces
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Low risk

Several instructions direct the agent to external Skills absent from this audit

Source references: 2
What we found

The Skill delegates several design topics to other `samber/cc-skills-golang` Skills, whose instructions and permissions are not included in the supplied complete source.

Why this matters

If the host resolves these references automatically, agent behavior may be influenced by instructions that were not reviewed here and may change independently. The actual risk depends on those external Skills.

What this evidence establishes

These lines only say to “see” other skills and note that a company skill may supersede this one; they do not command installation, download, or automatic execution. If the host automatically loads named external skills, they could expand the instruction and permission surface, but the supplied source neither establishes that behavior nor includes those skills. The actual risk is therefore unresolved. The user can ask whether cross-references trigger loading and review each referenced skill first.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:279In the instructionsOpen original file
- → See `samber/cc-skills-golang@golang-naming` skill for interface naming conventions (Reader, Closer, Stringer)- → See `samber/cc-skills-golang@golang-design-patterns` skill for functional options, constructors, and builder patterns- → See `samber/cc-skills-golang@golang-dependency-injection` skill for DI patterns using interfaces- → See `samber/cc-skills-golang@golang-code-style` skill for value vs pointer function parameters (distinct from receivers)- → See `samber/cc-skills-golang@golang-gopls` skill for safe rename and the `implementInterface` code action — renaming a method or receiver that participates in interface satisfaction updates every call site and refuses a rename that would silently break the interface, which grep/sed cannot detect
Show 1 other places
SKILL.md:24In the instructionsOpen original file
> **Community default.** A company skill that explicitly supersedes `samber/cc-skills-golang@golang-structs-interfaces` skill takes precedence.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill's stated purpose is to guide Go struct and interface design, with permission to read, edit, and write Go files in the project.

View source
SKILL.md:3In the instructionsOpen original file
name: golang-structs-interfacesdescription: 'Golang struct and interface design patterns — composition, embedding, type assertions, type switches, interface segregation, dependency injection via interfaces, struct field tags, and pointer vs value receivers. Use this skill when designing Go types, defining or implementing interfaces, embedding structs or interfaces, writing type assertions or type switches, adding struct field tags for JSON/YAML/DB serialization, or choosing between pointer and value receivers. Also use when the user asks about "accept interfaces, return structs", compile-time interface checks, or composing small interfaces into larger ones.'user-invocable: true
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:  - "**/*.go"---

The main content consists of design rules and examples; it explicitly requires comma-ok type assertions to avoid runtime crashes on type mismatches.

View source
SKILL.md:175In the instructionsOpen original file
## Type Assertions & Type SwitchesType assertions MUST use the comma-ok form (`s, ok := val.(string)`) — the single-value form panics on a type mismatch instead of branching. Use a type switch to dispatch on the dynamic type, and an assertion to a small optional interface (`if f, ok := w.(Flusher); ok`) to exploit richer implementations without widening the declared parameter type.→ See [Type Assertions & Type Switches](references/type-assertions.md) for type switch ordering, nil cases, and the optional-behavior pattern.

The Skill recommends Go static analysis and race detection. These commands may compile or test the project, but the shown commands do not install software, upload data, or delete files.

View source
references/struct-fields.md:71In the instructionsOpen original file
**Diagnose:** 1- `go vet ./...` — `copylocks` reports every value copy of a lock-bearing struct 2- `go test -race ./...` — surfaces the data races a silent copy introduces
Start here · InstructionsSKILL.md
golang-structs-interfaces
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 5 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/struct-fields.mdFull text included
  • references/type-assertions.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/struct-fields.mdSupporting file
  • references/type-assertions.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "🧩"    homepage: https://github.com/samber/cc-skills-golang    requires:
references/struct-fields.md:46In the instructionsOpen original file
// noCopy may be added to structs which must not be copied after first use.// See https://pkg.go.dev/sync#noCopytype noCopy struct{}
Run commands
SKILL.md:17In the instructionsOpen original file
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent AskUserQuestionpaths:
Change files
references/type-assertions.md:49In the instructionsOpen original file
func writeData(w io.Writer, data []byte) error {    if _, err := w.Write(data); err != nil {        return err
Lines read
598
File checksum (to compare versions)
8e1d0def0ee9aa4e186d1ee5a72afc853916d207a001876ff3737ee085ede713