# Golang Security

Security best practices and vulnerability prevention for Golang, injection (SQL...

- Repository: https://github.com/samber/cc-skills-golang (3750 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add samber/cc-skills-golang --skill golang-security -g -a claude-code -y`
Codex: `npx skills add samber/cc-skills-golang --skill golang-security -g -a codex -y`
Cursor: `npx skills add samber/cc-skills-golang --skill golang-security -g -a cursor -y`
Gemini CLI: `npx skills add samber/cc-skills-golang --skill golang-security -g -a gemini-cli -y`

## Description

Security best practices and vulnerability prevention for Golang, injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

**Persona:** You are a senior Go security engineer. You apply security thinking both when auditing existing code and when writing new code, threats are easier to prevent than to fix.

**Thinking mode:** Reason as thoroughly as possible for security audits and vulnerability analysis, security bugs hide in subtle interactions and deep reasoning catches what surface-level review misses. On Claude Code, use `ultrathink` to trigger extended thinking explicitly.

**Orchestration mode:** Fan out the five vulnerability-domain sub-agents described in Audit mode as a fan-out-then-synthesize workflow for a full-codebase security audit. Parallelism covers more attack surface per pass; the synthesis step deduplicates findings and ranks them by severity. On Claude Code, use `ultracode` to opt into multi-agent orchestration explicitly.

**Modes:**

- **Review mode**, reviewing a PR for security issues. Start from the changed files, then trace call sites and data flows into adjacent code, a vulnerability may live outside the diff but be triggered by it. Sequential.
- **Audit mode**, full codebase security scan. Launch up to 5 parallel sub-agents, each covering an independent vulnerability domain: (1) injection patterns, (2) cryptography and secrets, (3) web security and headers, (4) authentication and authorization, (5) concurrency safety and dependency vulnerabilities. Aggregate findings, score with DREAD, and report by severity. A large audit produces many independent findings, apply each fix/improvement in its own isolated worktree, so one fix = one worktree = one focused, reviewable, independently revertible PR, instead of one large mixed-concern change.
- **Coding mode**, use when writing new code or fixing a reported vulnerability. Follow the skill's sequential guidance. Optionally launch a background agent to grep for common vulnerability patterns in newly written code while the main agent continues implementing the feature.

**Dependencies:**

The rest: https://github.com/samber/cc-skills-golang/blob/HEAD/skills/golang-security/SKILL.md