跳转到正文
skillsafebeta
← 报告库
用途分类 / 开发辅助

Golang Naming Skill 安全审计

作者说它能做什么（原文）

Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, Statu

第三方安全检查结论

发现安全风险

已检查文件
7
发现的风险
3
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。发现 1 项风险
中风险

应用强制命名规则可能造成大范围、破坏兼容性的代码重命名

原文依据：3 处
发现了什么

该 Skill 将多项偏好表述为 MUST/NEVER，并明确说应用这些修复意味着重命名现有标识符。导出名称、接口方法、构造函数或枚举成员一旦改名，可能影响整个工作区及外部调用者。文本自身承认手工编辑可能漏掉调用点或破坏接口满足关系。

为什么需要注意

如果代理把审查请求理解为直接重构，用户可能得到跨文件持久修改、编译失败、接口不再实现，或公共 API 不兼容。

该 Skill 不仅提供建议，还获准 Edit/Write，并明确表示应用修复会重命名现有标识符。若代理在用户要求重构或应用命名修复时更改导出 API、接口方法或枚举名，工作区内外的调用者都可能受到影响。文档承认手工编辑可能遗漏调用点或破坏接口满足关系，并建议使用另一个未随本来源提供的 Skill。用户可将其限制为只读审查，或要求先列出重命名范围并验证所有调用点。

SKILL.md:17来自说明文档打开原文件
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
查看另外 2 个位置
SKILL.md:65来自说明文档打开原文件
All Go identifiers MUST use `MixedCaps` (or `mixedCaps`). NEVER use underscores in identifiers — the only exceptions are test function subcases (`TestFoo_InvalidInput`), generated code, and OS/cgo interop. This is load-bearing, not cosmetic — Go's export mechanism relies on capitalization, and tooling assumes MixedCaps throughout.
SKILL.md:157来自说明文档打开原文件
Applying these fixes means renaming existing identifiers — → See `samber/cc-skills-golang@golang-gopls` skill to do it safely: its rename updates every call site across the workspace and refuses a rename that would break interface satisfaction, which a grep/sed or manual Edit-based rename silently misses.
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 1 项风险
中风险

命名指导请求了超出只读审查所需的 Git 和 Agent 权限

原文依据：3 处
发现了什么

清单允许 Bash(git:*) 和 Agent，没有把 Git 限制为只读子命令。命名建议本身不需要推送、重置、删除分支、提交或委派。源码没有指示执行这些操作，但权限范围允许支持相关操作的运行环境这么做。

为什么需要注意

若宿主按通配符授予全部 Git 子命令，错误或被误导的代理可能改变提交历史、远端状态或工作树；Agent 委派还会扩大可接触仓库内容和执行操作的主体范围。

清单授予任意 git 子命令和 Agent 委派能力，而该 Skill 的声明用途是 Go 命名决策，正文没有给出需要提交、推送、重置、删分支或委派的流程。因此这些权限超出核心用途；风险只在运行环境实际允许并由代理调用时出现，源码并不证明会执行。用户可要求禁用 Agent，并把 Git 限制为 status、diff 等只读操作。

SKILL.md:17来自说明文档打开原文件
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
查看另外 2 个位置
SKILL.md:2来自说明文档打开原文件
---name: golang-namingdescription: "Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, StatusReady vs StatusUnknown at iota 0), debating Go package names (utils/helpers anti-patterns), or asking about Go naming best practices. Also trigger when the user mentions MixedCaps vs snake_case, ALL_CAPS constants, Get-prefix on getters, or error string casing. Do NOT use for general Go implementation questions that don't involve naming decisions."user-invocable: true
SKILL.md:3来自说明文档打开原文件
name: golang-namingdescription: "Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, StatusReady vs StatusUnknown at iota 0), debating Go package names (utils/helpers anti-patterns), or asking about Go naming best practices. Also trigger when the user mentions MixedCaps vs snake_case, ALL_CAPS constants, Get-prefix on getters, or error string casing. Do NOT use for general Go implementation questions that don't involve naming decisions."user-invocable: true
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。发现 1 项风险
低风险

推荐调用未包含在本次审计范围内的其他 Skill

原文依据：3 处
发现了什么

该 Skill 引导代理转向 golang-gopls、golang-lint、golang-code-style、golang-refactoring 等外部 Skill。这些依赖的内容、权限和安装行为未包含在提供的来源中，因此本次审计结论不能覆盖它们。

为什么需要注意

如果运行环境自动解析或安装这些推荐项，用户可能在没有单独审查的情况下扩大代码修改、命令执行或供应链信任范围。

该 Skill 明确引导使用 golang-gopls、golang-lint、golang-code-style 和 golang-refactoring 等其他 Skill；其中 gopls 引用与实际跨工作区重命名有关。提供的来源不包含这些 Skill 的指令、脚本或权限，所以无法据此评估它们。这里没有自动安装或自动调用指令，风险仅在用户或代理随后加载它们时产生；用户可要求在启用前单独审计其来源与权限。

SKILL.md:157来自说明文档打开原文件
Applying these fixes means renaming existing identifiers — → See `samber/cc-skills-golang@golang-gopls` skill to do it safely: its rename updates every call site across the workspace and refuses a rename that would break interface satisfaction, which a grep/sed or manual Edit-based rename silently misses.
查看另外 2 个位置
SKILL.md:161来自说明文档打开原文件
Many naming convention issues are caught automatically by linters: `revive`, `predeclared`, `misspell`, `errname`. See `samber/cc-skills-golang@golang-lint` skill for configuration and usage.
SKILL.md:165来自说明文档打开原文件
- → See `samber/cc-skills-golang@golang-code-style` skill for broader formatting and style decisions- → See `samber/cc-skills-golang@golang-structs-interfaces` skill for interface naming depth and receiver design- → See `samber/cc-skills-golang@golang-lint` skill for automated enforcement (revive, predeclared, misspell, errname)- → See `samber/cc-skills-golang@golang-gopls` skill for safe rename when applying a naming fix- → See `samber/cc-skills-golang@golang-refactoring` skill for how to apply a rename safely at scale (gopls Rename/Inline, blast-radius mapping, staged PR workflow) once you've decided what to rename identifiers to
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 的主要作用是为 Go 代码提供命名规则，并明确覆盖编写、审查和重构场景。规则包括标识符、构造函数、布尔字段、错误、枚举和测试名称。

查看原文
SKILL.md:2来自说明文档打开原文件
---name: golang-namingdescription: "Go (Golang) naming conventions — covers packages, constructors, structs, interfaces, constants, enums, errors, booleans, receivers, getters/setters, functional options, acronyms, test functions, and subtest names. Use this skill when writing new Go code, reviewing or refactoring, choosing between naming alternatives (New vs NewTypeName, isConnected vs connected, ErrNotFound vs NotFoundError, StatusReady vs StatusUnknown at iota 0), debating Go package names (utils/helpers anti-patterns), or asking about Go naming best practices. Also trigger when the user mentions MixedCaps vs snake_case, ALL_CAPS constants, Get-prefix on getters, or error string casing. Do NOT use for general Go implementation questions that don't involve naming decisions."user-invocable: truelicense: MIT
SKILL.md:34来自说明文档打开原文件
## Quick Reference| Element | Convention | Example || --- | --- | --- |

清单声明不执行安装，但请求了读取、编辑、写入、Go/linters/Git 命令和 Agent 委派能力。这些是权限声明，并不证明任何命令或修改已经发生。

查看原文
SKILL.md:13来自说明文档打开原文件
    homepage: https://github.com/samber/cc-skills-golang    requires:      bins:        - go    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:

主体文件把详细规则分散到五个随附参考文件中；提供的引用关系均有对应文件。它还另外推荐多个不在本次来源内的社区 Skill。

查看原文
SKILL.md:116来自说明文档打开原文件
For complete rules, examples, and rationale, see:- **[Packages, Files & Import Aliasing](./references/packages-files.md)** — Package naming (single word, lowercase, no plurals), file naming conventions, import alias patterns (only use on collision to avoid cognitive load), and directory structure.- **[Variables, Booleans, Receivers & Acronyms](./references/identifiers.md)** — Scope-based naming (length matches scope: `i` for 3-line loops, longer names for package-level), single-letter receiver conventions (`s` for Server), acronym casing (URL not Url, HTTPServer not HttpServer), and boolean naming patterns (isReady, hasPrefix).- **[Functions, Methods & Options](./references/functions-methods.md)** — Getter/setter patterns (Go omits `Get` so `user.Name()` reads naturally), constructor conventions (`New` or `NewTypeName`), named returns (for documentation only), format function suffixes (`Errorf`, `Wrapf`), and functional options (`WithPort`, `WithLogger`).- **[Types, Constants & Errors](./references/types-errors.md)** — Interface naming (`Reader`, `Closer` suffix with `-er`), struct naming (nouns, MixedCaps), constants (MixedCaps, not ALL_CAPS), enums (type name prefix like `StatusReady`), sentinel errors (`ErrNotFound` variables), error types (`PathError` suffix), and error message conventions (lowercase, no punctuation).
SKILL.md:126来自说明文档打开原文件
- **[Test Naming](./references/testing.md)** — Test function naming (`TestFunctionName`), table-driven test field conventions (`input`, `expected`), test helper naming, and subcase naming patterns.
从这里开始 · 工作说明SKILL.md
golang-naming
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。

文件引用关系图

5 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录7 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/functions-methods.md已纳入全文
  • references/identifiers.md已纳入全文
  • references/packages-files.md已纳入全文
  • references/testing.md已纳入全文
  • references/types-errors.md已纳入全文
  • evals/evals.json已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • evals/evals.json配套文件
  • references/functions-methods.md配套文件
  • references/identifiers.md配套文件
  • references/packages-files.md配套文件
  • references/testing.md配套文件
  • references/types-errors.md配套文件

代码和说明中提到的操作

连接外部网站
SKILL.md:12来自说明文档打开原文件
    emoji: "🏷"    homepage: https://github.com/samber/cc-skills-golang    requires:
evals/evals.json:300来自说明文档打开原文件
    "description": "Tests WithContext suffix for context variants and In suffix for in-place mutations",    "prompt": "I have a Go data processing library. I need to add variants to existing functions:\n\n1. `Fetch(key string) ([]byte, error)` needs a variant that accepts a context.Context\n2. `Sort(items []Item) []Item` (returns a new sorted slice) needs an in-place variant that modifies the slice directly\n3. `ParseConfig(path string) (*Config, error)` needs a variant that panics instead of returning an error\n4. `Reverse(s string) string` (returns a new string) needs an in-place variant for byte slices\n5. `Query(sql string) (*Rows, error)` needs a context-aware variant\n\nWhat should the variant function names be? Write the signatures.",    "trap": "Model uses FetchCtx/FetchWithCtx instead of FetchWithContext, SortMut/SortSlice instead of SortIn, or ParseConfigOrPanic instead of MustParseConfig.",
运行命令
SKILL.md:17来自说明文档打开原文件
    install: []allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agentpaths:
修改文件
references/functions-methods.md:21来自说明文档打开原文件
// Verb-like: performs an actionfunc WriteFile(name string, data []byte) error { ... }func SendNotification(user *User) error { ... }
读取了多少行
1,186
文件校验值（用于核对版本）
8baf88e53325e10e2b8ee54627462f5b44da4451c9d1bd59ee1895187c244798