Golang configuration library using spf13/viper — layered precedence (flag > env > file > KV > default), BindPFlag/BindPFlags, SetEnvPrefix + SetEnvKeyReplacer + AutomaticEnv, ReadInConfig + ConfigFileNotFoundError, Unmarshal + mapstructure struct tags, Sub for sub-trees, WatchConfig + OnConfigChange for hot reload, viper.New() for test isolation, and remote KV integration. Apply when using or adop
Skill 直接建议执行 `go get github.com/spf13/viper@latest`。这会访问网络、下载执行时所依赖的最新发布内容，并通常更新项目的 `go.mod`/`go.sum`；相同操作在不同时间可能取得不同代码。
未经审查的新版本或其传递依赖可能改变构建行为、引入兼容性问题或扩大供应链风险，并留下持久的依赖文件变更。
该命令是正文中的安装建议，明确使用浮动的 `@latest`，因此执行时间会影响取得的版本，并会让 Go 工具访问依赖源及更新项目依赖记录。这是采用 Viper 时的正常操作，但不具备可复现的版本锁定。用户可要求作者给出经验证的具体版本，并在执行前审查 `go.mod`/`go.sum` 变更。源码未显示该命令会自行运行。
```bashgo get github.com/spf13/viper@latest```Skill 建议打印 `viper.AllSettings()` 来检查绑定。该调用返回已解析的全部配置，而 Viper 也可绑定 `GOOGLE_APPLICATION_CREDENTIALS` 等凭据相关环境变量。若项目还包含令牌、密码或连接串，这些值可能一并被打印。
终端记录、CI 日志或集中日志系统可能保存敏感配置，并向有日志读取权限的人暴露。
这是调试示例，并不会自动运行；但一旦用户照做，`AllSettings()` 会把当前已解析的整套配置写到终端或日志。该 Skill 同时展示了把凭据相关环境变量绑定进 Viper，因此实际项目中的密码、令牌或连接串也可能随配置一起暴露。用户可要求作者改为只打印指定的非敏感键，或在输出前脱敏。
Print all resolved values to verify your binding is correct:```gofmt.Println(viper.AllSettings())// map[database:map[host:localhost max_conn:25] port:8080]```Use `AutomaticEnv` for the common case. Use `BindEnv` when you need to bind to an env var with a name that doesn't follow your prefix/replacer convention (e.g., third-party env vars like `GOOGLE_APPLICATION_CREDENTIALS`).```go// Bind a specific non-prefixed env varviper.BindEnv("google.credentials", "GOOGLE_APPLICATION_CREDENTIALS")```Skill 请求可写文件、运行任意 `go:*` 与 `git:*` 命令、启动 Agent 和联网抓取。尤其 `git:*` 不限于只读操作；如果宿主按此字段授权，Skill 可修改仓库历史或与远端交互，尽管正文没有要求这样做。
在代理误判或受到项目内容诱导时，宽泛权限会扩大源码修改、依赖执行、Git 状态变更或数据发送的影响范围。证据只表明权限被请求，并不表明这些动作已经发生。
元数据确实声明了写文件、运行 `git:*`、启动 Agent 和联网读取等能力；若宿主把它当作授权，这些能力可影响仓库或访问网络。但源码没有展示任何 `git` 命令、Agent 调用或自动联网流程，而且该 Skill 的目的包括在 Go 项目中采用 Viper，因此写文件和运行 Go 工具并非明显越权。仅凭权限清单无法确定会执行危险操作；用户可在宿主中限制为任务实际需要的工具。
这项判断针对展示的代码和适用条件，不表示风险已经实际发生。 skill-library-version: "1.21.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths: - "**/*.go"---etcd 示例连接 `http://127.0.0.1:2379`，随后直接读取远程配置。若用户照搬模式到非本机或不可信网络，配置内容及更新可能缺乏传输加密和服务身份验证。
能观察或干预该网络路径的一方可能读取配置或篡改服务行为；如果配置含凭据，影响还包括敏感信息泄露。
示例确实使用未加密 HTTP，但目标严格是回环地址 `127.0.0.1`，Consul 示例也是 `localhost`；可见源码没有指示通过非本机或不可信网络传输配置。正文还说明远程配置是可选功能，并警告其网络与运行时依赖。若用户改成远程地址，TLS、认证和访问控制需要另行确认，但候选所述非本机风险并非当前示例的行为。
这项判断针对展示的代码和适用条件，不表示风险已经实际发生。Viper supports remote KV stores via the `viper/remote` sub-package. This keeps remote config behind an opt-in import:```goimport _ "github.com/spf13/viper/remote"// etcdviper.AddRemoteProvider("etcd3", "http://127.0.0.1:2379", "/config/myapp.yaml")viper.SetConfigType("yaml")viper.ReadRemoteConfig()// Consulviper.AddRemoteProvider("consul", "localhost:8500", "myapp/config")viper.SetConfigType("json")viper.ReadRemoteConfig()```**Caution:** Remote config adds network latency to startup and a runtime dependency. Use it only when you need centralized config across many service instances. For most applications, files + env vars are sufficient.这是一个面向 Go 项目的说明型 Skill，指导代理使用 Viper 读取配置文件、环境变量、命令行标志和远程 KV；提供的材料中没有可自动运行的脚本，安装列表也为空。
homepage: https://github.com/samber/cc-skills-golang requires: bins: - go install: [] skill-library-version: "1.21.0"# Using spf13/viper for layered configuration in GoViper resolves configuration values from multiple sources in a fixed precedence order. It has no user-facing surface — it doesn't define commands or flags. Its job is to answer "what is the value of key X right now?" by walking its source layers from highest to lowest priority.Skill 建议将配置来源按固定优先级合并，显式设置、标志和环境变量可覆盖文件或远程 KV 中的值。实际生效配置可能因此不同于磁盘文件内容。
Viper resolves a key by walking sources in this order (first set value wins):```1. explicit Set() — viper.Set("key", val) highest priority2. flag — bound pflag.Flag3. env var — BindEnv / AutomaticEnv4. config file — ReadInConfig / MergeInConfig5. KV remote — etcd / Consul6. default — viper.SetDefault("key", val) lowest priority```热重载示例会启动后台文件监视，并明确要求在应用前解析、验证和同步更新共享配置；这部分包含避免数据竞争和错误配置替换当前配置的防护。
`WatchConfig` starts a background goroutine that watches the config file using fsnotify. Call it after `ReadInConfig`.Always validate reloaded config before applying it — an invalid config mid-reload should keep the previous working config:```goviper.OnConfigChange(func(e fsnotify.Event) { var candidate Config if err := viper.Unmarshal(&candidate); err != nil { log.Printf("reload: invalid config, keeping previous: %v", err) return } if err := validate(candidate); err != nil { log.Printf("reload: validation failed, keeping previous: %v", err) return } applyConfig(candidate)})```下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。
SKILL.md已纳入全文references/binding-and-env.md已纳入全文references/sources-and-formats.md已纳入全文references/testing-and-isolation.md已纳入全文references/unmarshal.md已纳入全文references/watch-and-reload.md已纳入全文evals/evals.json已纳入全文这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。
SKILL.md工作说明evals/evals.json配套文件references/binding-and-env.md配套文件references/sources-and-formats.md配套文件references/testing-and-isolation.md配套文件references/unmarshal.md配套文件references/watch-and-reload.md配套文件 emoji: "🔧" homepage: https://github.com/samber/cc-skills-golang requires:- [pkg.go.dev/github.com/spf13/viper](https://pkg.go.dev/github.com/spf13/viper)- [github.com/spf13/viper](https://github.com/spf13/viper)- [pkg.go.dev/github.com/spf13/viper](https://pkg.go.dev/github.com/spf13/viper)- [github.com/spf13/viper](https://github.com/spf13/viper) skill-library-version: "1.21.0"allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent WebFetch mcp__context7__resolve-library-id mcp__context7__query-docs Bash(godig:*) Bash(gopls:*) LSP mcp__gopls__*paths:```bashgo get github.com/spf13/viper@latest "description": "Tests graceful handling of ConfigFileNotFoundError for optional config files", "prompt": "My Go service uses viper to read a config file. When users run it without a config file, it crashes with 'Config File config not found in ...'. The config file should be optional. How do I fix this?", "trap": "Without the skill, the model may suggest pre-checking if the file exists before calling ReadInConfig, or using os.Stat. The correct pattern is errors.As with viper.ConfigFileNotFoundError.", "prompt": "I want my Go service to ship with a built-in default config file, but let ops teams drop an override.yaml in /etc/myapp/ to customize specific values without copying the whole config. How do I implement this layered loading?" … "trap": "Without the skill, the model may suggest reading only one file or writing custom merge logic. MergeInConfig is the viper primitive for this — base file first, then MergeInConfig for the override.", "assertions": [- [Injecting viper into your app](#injecting-viper-into-your-app)- [Reading config files in tests](#reading-config-files-in-tests)- [t.Setenv interactions](#tsetenv-interactions) "id": "9.3", "text": "Recommends testing hot-reload using direct writes (os.WriteFile) rather than editor saves" },// reliable in tests:os.WriteFile("config.yaml", newContent, 0644) "description": "Tests BindEnv for env vars that don't follow the app prefix convention", "prompt": "My Go service uses viper with SetEnvPrefix('MYAPP') and AutomaticEnv(). I also need to read GOOGLE_APPLICATION_CREDENTIALS from the environment and expose it as viper key 'google.credentials'. The prefix makes AutomaticEnv look for MYAPP_GOOGLE_CREDENTIALS. How do I bind to the exact env var name?", "trap": "Without the skill, the model may suggest removing the prefix or reading via os.Getenv. BindEnv can bind a specific key to a specific env var name, bypassing the prefix.", "prompt": "My Go service uses viper with SetEnvPrefix('MYAPP') and AutomaticEnv(). I also need to read GOOGLE_APPLICATION_CREDENTIALS from the environment and expose it as viper key 'google.credentials'. The prefix makes AutomaticEnv lo … "trap": "Without the skill, the model may suggest removing the prefix or reading via os.Getenv. BindEnv can bind a specific key to a specific env var name, bypassing the prefix.", "assertions": [ "id": "14.1", "text": "Uses viper.BindEnv(\"google.credentials\", \"GOOGLE_APPLICATION_CREDENTIALS\")" },