golang-dependency-management Skill for Claude Code: Go Modules and Dependencies

Makes Claude manage go.mod and dependencies carefully: ask before adding packages, upgrade safely and scan for known vulnerabilities.

Installs: 40.7K; on skills.sh
Stars: 3.7K; on GitHub
Files: 7; besides SKILL.md
Updated: Nov 2026; last repo commit

golang-dependency-management makes Claude treat every new dependency as a long-term commitment. Its first rule says AI agents must ask you before running go get to add a dependency, because they can suggest packages that are unmaintained or unnecessary when the standard library already does the job.

It also covers go.mod and go.sum, safe upgrades with go get -u=patch, govulncheck before releases, tool directives, vendoring, conflicts and workspaces. It lists go and govulncheck as required programs and bundles six reference guides.

Good for

Go developers adding, removing or upgrading dependencies
Anyone who wants govulncheck and audit habits built into the agent
Teams working with replace directives, vendoring or go.work workspaces

Install golang-dependency-management

Claude Code

Copy this prompt.

Install the golang-dependency-management skill in Claude Code. Run this command:

/plugin marketplace add samber/cc
/plugin install cc-skills-golang@samber

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route, not several. The README says the skills cross-reference each other and a subset gives a partial and potentially inconsistent view, so the plugin or the whole-set CLI command is the better choice. The plugin installs the repo's 46 skill folders; its manifest declares no hooks, commands or MCP servers. Claude Code names plugin skills /plugin-name:skill-name, so after the plugin install the full name is /cc-skills-golang:golang-dependency-management. The samber/cc marketplace lists seven plugins; the second command installs only cc-skills-golang.

From the project README. Source.

What's in the skill

When it loads

Dependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

Sections in SKILL.md

AI Agent Rule: Ask Before Adding Dependencies
Key Rules
go.mod & go.sum
Essential Commands
Vendoring
Installing & Upgrading Dependencies
Adding a Dependency
Upgrading
Removing a Dependency
Installing CLI Tools
Module target note
Deep Dives
Cross-References
Quick Reference

Key facts

Author: samber (metadata.author in SKILL.md)
License: MIT (license field in SKILL.md)
Version: 1.3.1 (metadata.version in SKILL.md)
Installs on skills.sh: 40,651 as of 2026-11-02
GitHub stars: 3,749 for the whole samber/cc-skills-golang repo, 2026-11-02
Last repo commit: 2026-11-01
What is inside: 8 files including SKILL.md: 6 reference guides, an evals file. No scripts.
Needs: Programs named in the SKILL.md frontmatter: go, govulncheck
Works in: Designed for Claude Code, Codex or similar harness, and for projects using Golang (compatibility field in SKILL.md)

What it includes

Claude must get your OK before go get adds a new dependency
It checks the standard library first, then license, alternatives and why the package is needed.
Runs code · Ask before adding
Commit go.sum, run govulncheck, run go mod tidy
Four rules for go.sum, govulncheck ./..., maintenance checks and go mod tidy before each dependency commit.
Runs code · Key rules
tidy, download, verify, vendor, edit, graph, why
A table of what each command is for.
Runs code · Essential go mod commands
Prefer go get -u=patch; tool directives for Go 1.24+
Tells Claude to pin CLI tools with tool directives in go.mod and use tools.go only for older Go.
Runs code · Installing and upgrading
Semantic versioning, MVS, replace, exclude and retract
Deep dives on how Go picks versions and how to resolve conflicts.
Read · references/versioning.md and conflicts.md
govulncheck, outdated dependencies, binary size with goweight
Audit workflow for the dependency tree.
Runs code · references/auditing.md
go.work, Dependabot or Renovate, and go mod graph
Multi-module work, update bots and dependency graph visuals.
Read · references/workspaces.md, automated-updates.md, visualization.md

From the official docs

Permissions

Low risk

Claude can edit your Go files and run go and git commands while this skill is active. Work on a branch and read the diff before you commit.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It edits files and runs commands in your project
The frontmatter lists Edit, Write and these shell commands: go:*, golangci-lint:*, git:*, govulncheck:*. Work on a branch and read the diff before you commit. github.com
It edits go.mod and can download modules
It runs go commands such as go get, go mod tidy and go mod vendor, which change go.mod, go.sum and vendor/. The skill says to ask you before adding a new dependency. Commit first so you can review the diff. github.com
SKILL.md lists install commands for its tools
Its Dependencies list gives these commands, which download and build or install software on your machine if Claude or you run them: govulncheck: go install golang.org/x/vuln/cmd/govulncheck@latest. Check each before approving. github.com
The recommended plugin route installs the whole repo
The plugin route and the --all skills CLI command add all 46 skill folders in the repo, not only this one. The plugin manifest (.claude-plugin/plugin.json, version 2.0.1) declares a name, description, author, license and keywords, and lists no hooks, commands or MCP servers. The skills CLI docs say --all installs every skill into every agent it supports without prompts. github.com

Technical details

Sign-in and keys	SKILL.md names no account or API key.
Scopes	Reads and edits files in your Go project Runs the shell commands listed in the allowed-tools field: go:, golangci-lint:, git:, govulncheck:

Questions

What does golang-dependency-management do?

It makes Claude handle Go modules carefully: ask you before adding a dependency, prefer standard library solutions, upgrade with go get -u=patch, run govulncheck before releases, and deal with replace, vendoring and workspaces.

How do I install golang-dependency-management?

Install the whole golang set, not only this skill. The README calls the skills atomic, cross-referencing units and says a partial install gives a potentially inconsistent view. The install box lists the Claude Code plugin (/plugin marketplace add samber/cc, then /plugin install cc-skills-golang@samber), the skills CLI for the whole set or for this skill alone, and the README's Codex, Gemini CLI, Cursor and OpenCode routes. The README documents no Claude app route, so none is listed.

Do I need the other golang skills with golang-dependency-management?

Installing the set is the safer choice. SKILL.md hands neighboring topics to other skills: golang-pkg-go-dev, golang-popular-libraries, golang-continuous-integration, golang-security. The README says to install the general-purpose skills together, and the whole-set install does that.

What does golang-dependency-management need on my machine?

The frontmatter names these programs: go, govulncheck. SKILL.md names no API key or account.

Is golang-dependency-management safe?

It is instruction text and reference files, and the folder bundles no scripts. When you use it, Claude can edit files and run go, golangci-lint, git and govulncheck commands in your project, as its frontmatter allows. Work on a branch, read the diff and approve commands you do not recognize.

golang-dependency-management vs golang-popular-libraries?

This skill is about how to add, upgrade, audit and remove dependencies. SKILL.md says golang-popular-libraries holds a curated list of vetted libraries to recommend from.

Does golang-dependency-management work in Codex, Cursor or the Claude app?

The SKILL.md compatibility field says it is designed for Claude Code, Codex or a similar harness, and the README says the skills are built for Claude Code, Codex, Gemini, Copilot, Antigravity and Cursor. The install box covers Claude Code, Codex, Gemini CLI, Cursor, OpenCode and the skills CLI. The README documents no Claude app route.

Will Claude add packages without asking?

SKILL.md says AI agents must ask you for confirmation before running go get to add a new dependency. Upgrading an existing dependency with go get -u is described as safe.

Information

updated Nov 2, 2026

Repository: samber/cc-skills-golang
Folder: skills/golang-dependency-management

samber/cc-skills-golang skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 6

cc-skills-golang README · github.com
skills CLI commands · github.com
cc-skills-golang plugin.json · github.com
samber/cc marketplace.json · github.com
Claude Code skills · code.claude.com
golang-dependency-management SKILL.md · github.com