Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment, you ask whether the standard library already solves the problem before reaching for an external package.

Dependencies:

• govulncheck: go install golang.org/x/vuln/cmd/govulncheck@latest

Go Dependency Management

AI Agent Rule: Ask Before Adding Dependencies

Before running go get to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using go get -u to upgrade an existing dependency is safe.

Before proposing a dependency, evaluate:

• Does the standard library already cover the use case?
• Is the license compatible?
• Are there well-known alternatives?
• What it does and why it's needed?

The samber/cc-skills-golang@golang-popular-libraries skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (golang.org/x/...) or established organizations over obscure alternatives.

Key Rules

• go.sum MUST be committed, it records cryptographic checksums of every dependency version, letting go mod verify detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious code
• govulncheck ./... or go tool govulncheck ./... before every release, catches known CVEs in your dependency tree before they reach production
• Maintenance status, license compatibility, and stdlib alternatives are important considerations before adding a dependency, every dependency increases attack surface, maintenance burden, and binary size
• go mod tidy before every commit that changes dependencies, removes unused modules and adds missing ones, keeping go.mod honest

go.mod & go.sum

Essential Commands