Skip to content
skillsafebeta
← Report library
Purpose / Development

Golang Uber Dig Skill Security Audit

What the author says it does (original text)

Implements dependency injection in Golang using uber-go/dig — reflection-based container, Provide/Invoke, dig.In/dig.Out parameter and result objects, named values, value groups, optional dependencies, scopes, and Decorate. Apply when using or adopting uber-go/dig, when the codebase imports `go.uber.org/dig`, or when wiring an application graph at startup. For higher-level lifecycle and modules, s

Independent security check

Security risks found

Files checked
5
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

An example returns raw internal error text to HTTP clients

Source references: 3
What we found

The request-handler example directly calls `http.Error(w, err.Error(), 500)`. If adopted in a project, the underlying database or service error is copied into the response.

Why this matters

The response could reveal database details, internal service names, file paths, query information, or other diagnostics that should remain in server-side logs.

This is a copyable request-handler example: when scoped invocation fails, it sends `err.Error()` directly as the body of a 500 response. If the error contains database addresses, query details, internal types, or configuration data, a remote client could see it. The example is not automatically executed, but the risk applies if adopted. A user can ask for a fixed public response while detailed errors are logged only server-side.

references/recipes.md:49In the instructionsOpen original file
func NewUserRoute(repo *UserRepo) RouteResult {    return RouteResult{Route: Route{        Pattern: "/users",        Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {            users, err := repo.List(r.Context())            if err != nil {                http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)                return            }            fmt.Fprintf(w, "%d users", len(users))        }),    }}
Show 2 other places
references/recipes.md:187In the instructionsOpen original file
    err := scope.Invoke(func(h *Handler) error {        return h.Serve(w, req)    })    if err != nil {        http.Error(w, err.Error(), 500)    }}
references/recipes.md:177In the instructionsOpen original file
func handle(w http.ResponseWriter, req *http.Request) {    scope := root.Scope("request")    // Request-scoped values    must(scope.Provide(func() *http.Request { return req }))    must(scope.Provide(func() RequestID { return RequestID(req.Header.Get("X-Request-ID")) }))    must(scope.Decorate(func(l *zap.Logger) *zap.Logger {        return l.With(zap.String("request_id", req.Header.Get("X-Request-ID")))    }))    err := scope.Invoke(func(h *Handler) error {        return h.Serve(w, req)    })    if err != nil {        http.Error(w, err.Error(), 500)    }}```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
Low risk

The visualization examples can truncate an existing graph.dot file

Source references: 3
What we found

The examples use `os.Create("graph.dot")`. At runtime, that call truncates an existing file of the same name before writing the dependency graph, and the examples ignore creation and write errors.

Why this matters

Existing `graph.dot` content could be irreversibly overwritten, while ignored errors can make a failed or partial output less obvious.

The visualization example calls `os.Create("graph.dot")`; if that name already exists in the working directory, Go truncates it before `dig.Visualize` writes new content. Creation and write errors are also ignored, so prior content could be lost without a clear report. This is example code and does not run merely because the Skill is loaded. A user can ask for target confirmation, a unique temporary file, or safe handling of existing files and errors.

references/advanced.md:86In the instructionsOpen original file
```gof, _ := os.Create("graph.dot")_ = dig.Visualize(c, f)// then: dot -Tpng graph.dot -o graph.png```
Show 2 other places
references/recipes.md:264In the instructionsOpen original file
```goerr := c.Invoke(run)if err != nil {    f, _ := os.Create("graph.dot")    defer f.Close()    _ = dig.Visualize(c, f, dig.VisualizeError(err))    log.Fatalf("wiring failed (graph in graph.dot): %v", err)}
references/advanced.md:84In the instructionsOpen original file
dig can emit the dependency graph in DOT format — useful when wiring becomes too tangled to reason about by reading code:```gof, _ := os.Create("graph.dot")_ = dig.Visualize(c, f)// then: dot -Tpng graph.dot -o graph.png```
Low risk

The installation command downloads a module and changes Go dependency records

Source references: 4
What we found

The guide directly presents `go get go.uber.org/dig` and declares permission to run Go commands. Running it normally contacts configured Go module sources and updates the current project's `go.mod` and potentially `go.sum`. The material does not show automatic execution.

Why this matters

Project dependency and checksum records are persistently changed, and network requests are sent to the configured module proxy or source host.

Legitimate use of this code

`go get go.uber.org/dig` is a conventional dependency-installation step shown in a code block and directly matches the stated purpose of adopting uber-go/dig; the metadata's automatic install list is empty. If a user or agent deliberately runs it, it will normally contact configured Go module sources and update project dependency files, but the source does not instruct automatic execution when the Skill loads. A user can still require review of `go.mod`/`go.sum` changes or execution in a network-restricted environment.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:13In the instructionsOpen original file
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []    skill-library-version: "1.19.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
Show 3 other places
SKILL.md:40In the instructionsOpen original file
```bashgo get go.uber.org/dig```
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.19.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
SKILL.md:34In the instructionsOpen original file
This skill is not exhaustive — refer to library documentation and code examples for more information:- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).- Context7 remains a fallback for docs not indexed on pkg.go.dev.```bashgo get go.uber.org/dig```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

The Skill requests unrestricted git-command access beyond its DI guidance purpose

Source references: 2
What we found

The stated purpose concerns Go dependency injection, but `Bash(git:*)` is allowed without restricting git to read-only operations. This pattern can cover push, hard reset, cleaning files, or deleting branches. The supplied material does not show that such commands run automatically.

Why this matters

If an agent misuses a dangerous git subcommand, or is induced to do so by project content while the Skill is active, it could rewrite local history, remove uncommitted files, or push code through the user's remote account.

The Skill is for Go dependency-injection guidance, yet its tool declaration permits every Bash command matching `git:*`, with no read-only restriction in the text. If the host enforces this field as a grant, the agent could have capabilities such as pushing, force-resetting, cleaning files, or deleting branches beyond the stated task. The source does not show those commands being run automatically. A user can ask the author to remove Git access or allow only named read-only subcommands.

SKILL.md:3In the instructionsOpen original file
name: golang-uber-digdescription: "Implements dependency injection in Golang using uber-go/dig — reflection-based container, Provide/Invoke, dig.In/dig.Out parameter and result objects, named values, value groups, optional dependencies, scopes, and Decorate. Apply when using or adopting uber-go/dig, when the codebase imports `go.uber.org/dig`, or when wiring an application graph at startup. For higher-level lifecycle and modules, see `samber/cc-skills-golang@golang-uber-fx` skill."user-invocable: true
Show 1 other places
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.19.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
Medium risk

The HTTP example listens on all network interfaces

Source references: 2
What we found

The example sets the server address to `:8080` and calls `ListenAndServe`. In Go, omitting the host normally listens on all available interfaces rather than restricting the service to localhost.

Why this matters

If host firewall, container-port, or cloud-network settings permit access, the example routes may become unintentionally reachable from a local network or the public internet.

The full HTTP example sets the address to `:8080` and then calls `ListenAndServe()`. Under normal Go networking semantics, an empty host binds available interfaces, so adopting it may expose the service to a local network or beyond rather than only localhost. The source does not show the Skill starting it automatically. A user can request an explicit `127.0.0.1:8080` default or documentation that external binding requires authorization, authentication, and firewall controls.

references/recipes.md:69In the instructionsOpen original file
func NewServer(p ServerParams) *http.Server {    mux := http.NewServeMux()    for _, r := range p.Routes {        mux.Handle(r.Pattern, r.Handler)    }    return &http.Server{Addr: ":8080", Handler: mux}}
Show 1 other places
references/recipes.md:86In the instructionsOpen original file
    err := c.Invoke(func(srv *http.Server) error {        log.Println("listening on", srv.Addr)        return srv.ListenAndServe()    })    if err != nil {
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a usage guide for uber-go/dig in Go projects, primarily providing dependency-injection architecture advice and examples; it declares no automatic installation steps.

View source
SKILL.md:16In the instructionsOpen original file
        - go    install: []    skill-library-version: "1.19.0"
SKILL.md:23In the instructionsOpen original file
**Persona:** You are a Go architect wiring an application graph with dig. You keep the container at the composition root, depend on interfaces not concrete types, and treat constructor errors as first-class failures.# Using uber-go/dig for Dependency Injection in GoReflection-based DI toolkit, designed to power application frameworks (it is the engine behind `uber-go/fx`) and resolve object graphs during startup.

The Skill declares permission to read and write the project, run Go and git commands, fetch web documentation, and invoke agents. These are permission declarations, not evidence that any such action has occurred.

View source
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.19.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:  - "**/*.go"---

Examples include starting an HTTP server, creating dependency-graph files, and structurally validating the graph with DryRun. These snippets take effect only if an agent writes them into a project or the user copies and runs them.

View source
SKILL.md:178In the instructionsOpen original file
    err := c.Invoke(func(srv *http.Server) error {        return srv.ListenAndServe()    })    if err != nil {
references/advanced.md:86In the instructionsOpen original file
```gof, _ := os.Create("graph.dot")_ = dig.Visualize(c, f)// then: dot -Tpng graph.dot -o graph.png```
references/testing.md:71In the instructionsOpen original file
```gofunc TestProductionGraph(t *testing.T) {    c := dig.New(dig.DryRun(true))    // Replicate every Provide() from main()    require.NoError(t, registerAll(c))    // Invoke the same root the production binary does    require.NoError(t, c.Invoke(func(*http.Server, *Worker, *MetricsExporter) {}))}````DryRun(true)` skips constructor execution — the graph is validated structurally. This catches missing-provider and type-mismatch errors without spinning up real DB connections.
Start here · InstructionsSKILL.md
golang-uber-dig
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 6 more sections are available in the original file.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/advanced.mdFull text included
  • references/recipes.mdFull text included
  • references/testing.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/advanced.mdSupporting file
  • references/recipes.mdSupporting file
  • references/testing.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:12In the instructionsOpen original file
    emoji: "⛏"    homepage: https://github.com/samber/cc-skills-golang    requires:
SKILL.md:31In the instructionsOpen original file
- [pkg.go.dev/go.uber.org/dig](https://pkg.go.dev/go.uber.org/dig)- [github.com/uber-go/dig](https://github.com/uber-go/dig)
SKILL.md:32In the instructionsOpen original file
- [pkg.go.dev/go.uber.org/dig](https://pkg.go.dev/go.uber.org/dig)- [github.com/uber-go/dig](https://github.com/uber-go/dig)
Run commands
SKILL.md:18In the instructionsOpen original file
    skill-library-version: "1.19.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:
SKILL.md:40In the instructionsOpen original file
```bashgo get go.uber.org/dig
Read files
SKILL.md:78In the instructionsOpen original file
err := c.Provide(func(cfg *Config) (*sql.DB, error) {    return sql.Open("postgres", cfg.DSN)})
references/recipes.md:112In the instructionsOpen original file
func NewDatabases(cfg *Config) (DBResult, error) {    rw, err := sql.Open("postgres", cfg.PrimaryDSN)    if err != nil {
references/recipes.md:116In the instructionsOpen original file
    }    ro, err := sql.Open("postgres", cfg.ReadOnlyDSN)    if err != nil {
Read keys or account settings
references/recipes.md:233In the instructionsOpen original file
        zap.String("service", cfg.ServiceName),        zap.String("env", cfg.Env),    )
Lines read
930
File checksum (to compare versions)
da2b5576204320e49a7e59af926194309cc583cc7a36152411244a5a495b52cf