Linting best practices and golangci-lint configuration for Golang projects — running linters, configuring .golangci.yml, suppressing warnings with nolint directives, interpreting lint output, and selecting linters. Use when configuring golangci-lint, asking about lint warnings or nolint suppressions, setting up code quality tooling, or choosing linters. Also use when the user mentions golangci-lin
安装命令从 GitHub 获取并构建 golangci-lint 的当前最新版本，没有固定版本号或校验值。相同指令在不同时间可能下载不同代码及其依赖。
如果上游发布、依赖链或分发账户遭破坏，安装或之后运行该二进制文件可能在用户权限下执行非预期代码；即使没有攻击，版本漂移也会改变修复结果。
依赖说明给出了可执行的 `go install ...@latest`，会在安装时从 GitHub 模块生态获取当时的最新版本，没有版本固定或校验步骤。因此用户执行它时，得到的代码和传递依赖可能随时间变化，并以用户权限安装可执行文件。这不是恶意行为的证据，但会降低构建可复现性并增加上游供应链风险。用户可要求作者提供经过测试的固定版本和校验/发布验证信息。
**Dependencies:**- golangci-lint: `go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest`该 Skill 明确要求在日常编码时后台运行自动修复，并在旧代码库清理时让多个子代理同时处理不同问题；其中一个命令以 `./...` 为范围，可修改整个 Go 模块，而不只是用户正在查看的文件。
格式化、导入和部分代码结构可能在主任务仍进行时被改写。多个代理同时编辑相关文件还可能产生冲突、覆盖尚未检查的改动，或形成范围较大的难审查差异。
该风险有源码支持。编码模式要求后台代理对“已修改文件”运行带 `--fix` 的命令；旧代码库模式则要求最多 5 个代理并发处理，其中自动修复覆盖 `./...`，其他代理也被要求修复代码。只有在用户采用这些模式且授权修改时才会发生；影响可能包括整个 Go 模块的批量改写及并发编辑冲突。用户可要求先仅运行不带 `--fix` 的检查、限定明确文件，并禁止并发写入。
- **Setup mode** — configuring `.golangci.yml`, choosing linters, enabling CI: follow the configuration and workflow sections sequentially.- **Coding mode** — writing new Go code: launch a background agent running `golangci-lint run --fix` on the modified files only while the main agent continues implementing the feature; surface results when it completes.- **Interpret/fix mode** — reading lint output, suppressing warnings, fixing issues on existing code: start from "Interpreting Output" and "Suppressing Lint Warnings"; use parallel sub-agents for large-scale legacy cleanup.When adopting linting on a legacy codebase, use up to 5 parallel sub-agents to fix independent linter categories simultaneously:- Sub-agent 1: Run `golangci-lint run --fix ./...` for auto-fixable issues- Sub-agent 2: Fix security linter findings (bodyclose, sqlclosecheck, gosec)- Sub-agent 3: Fix error handling issues (errcheck, nilerr, wrapcheck)- Sub-agent 4: Fix style and formatting (gofumpt, goimports, revive)- Sub-agent 5: Fix code quality (gocritic, unused, ineffassign)该 Skill 用于配置和运行 golangci-lint，并允许读取、编辑和写入 Go 源文件及 `.golangci.yml`；它还声明可运行 Go、golangci-lint 和 Git 命令。
bins: [golangci-lint]allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths: - "**/*.go" - ".golangci.yml"---推荐配置会检查测试文件，最多并行运行四项分析，并启用正确性、风格、复杂度、安全、资源、日志和测试等多类检查器。
version: "2"run: concurrency: 4 # Timeout for analysis timeout: 5m # Include test files tests: true - goconst # repeated literals that should be constants # security & resources - gosec # security scanner: SQL injection, hardcoded credentials, weak crypto, path traversal - bidichk # dangerous bidirectional Unicode sequences (trojan source CVE-2021-42574) - bodyclose # unclosed HTTP response bodies (connection leaks) - noctx # HTTP requests missing context.Context - containedctx # context.Context stored in struct fields instead of passed as parameter - fatcontext # context.WithValue/WithCancel in loops (unbounded context chain, memory leak) - sqlclosecheck # unclosed sql.Rows and sql.Stmt - rowserrcheck # unchecked sql.Rows.Err() after iteration # logging文档总体要求先修复根因，并要求每个 `nolint` 抑制指定检查器且说明理由；安全与资源泄漏检查不应轻易被抑制。
Use `//nolint` directives sparingly — fix the root cause first.1. **//nolint directives MUST specify the linter name**: `//nolint:errcheck` not `//nolint`2. **//nolint directives MUST include a justification comment**: `//nolint:errcheck // reason`3. **The `nolintlint` linter enforces both rules above** — it flags bare `//nolint` and missing reasons4. **NEVER suppress security linters** (gosec, bodyclose, sqlclosecheck) without a very strong reason下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。
SKILL.md已纳入全文assets/.golangci.yml已纳入全文references/linter-reference.md已纳入全文references/nolint-directives.md已纳入全文evals/evals.json已纳入全文这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。
SKILL.md工作说明assets/.golangci.yml配套文件evals/evals.json配套文件references/linter-reference.md配套文件references/nolint-directives.md配套文件 emoji: "🧹" homepage: https://github.com/samber/cc-skills-golang requires: bins: [golangci-lint]allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:```bash# Run all configured linters # security & resources - gosec # security scanner: SQL injection, hardcoded credentials, weak crypto, path traversal - bidichk # dangerous bidirectional Unicode sequences (trojan source CVE-2021-42574)- **gosec** — Security scanner: SQL injection, hardcoded credentials, weak crypto, path traversal, unsafe usage, and 50+ other rules. The primary SAST tool in the config — never suppress without strong justification.- **bidichk** — Detects dangerous bidirectional Unicode sequences (CVE-2021-42574 trojan source attack — code that looks safe but executes differently)