PlugWiki

golang-security Skill (samber) for Claude Code: Go Security

Makes Claude review, audit and write Go code with security in mind: injection, crypto, secrets, SSRF and threat modelling.

Installs
43.3K
on skills.sh
Stars
3.7K
on GitHub
Files
13
besides SKILL.md
Updated
Nov 2026
last repo commit

golang-security makes Claude act as a senior Go security engineer. It has three modes: review a PR (tracing data flow beyond the diff), audit a whole codebase with up to 5 parallel sub-agents, and coding mode for new code or fixes. It ranks findings with DREAD severity and uses STRIDE for threat modelling.

It covers SQL and command injection, XSS, path traversal, SSRF, cryptography, cookies, secrets, memory safety and PII in logs. SKILL.md lists govulncheck as a dependency and shows gosec for static analysis. Audit mode applies each fix in its own git worktree.

Good for

  • Go developers who want security checked while they code
  • Reviewers looking for vulnerabilities in a pull request
  • Teams running a security audit of a Go service

Install golang-security

Claude Code

  1. 1

    Copy this prompt.

    Install the golang-security skill in Claude Code. Run this command:

/plugin marketplace add samber/cc
/plugin install cc-skills-golang@samber

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

The README says these skills are built as atomic, cross-referencing units, and that installing only a subset gives a partial and potentially inconsistent view of the guidelines. It recommends installing all the general-purpose skills together, which the plugin does. Its manifest lists no hooks or MCP servers, and the repo holds 46 skills. Use the skills CLI line only if you want just this one. Pick one route, not both.

From the project README. Source.

What's in the skill

When it loads

Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

Sections in SKILL.md

  1. Overview
  2. Security Thinking Model
  3. Severity Levels
  4. Research Before Reporting
  5. Threat Modeling (STRIDE)
  6. Quick Reference
  7. Detailed Categories
  8. Code Review Checklist
  9. Tooling & Verification
  10. Static Analysis & Linting
  11. Security Testing
  12. Common Mistakes
  13. Security Anti-Patterns
  14. Cross-References
  15. Additional Resources

Key facts

Author
samber, per the SKILL.md metadata
Repo
samber/cc-skills-golang
Installs on skills.sh
43,276 (Nov 2, 2026)
GitHub stars
3,749 (Nov 2, 2026)
License
MIT
Last commit
Nov 1, 2026
Skill version
1.2.2
Files
14 files including SKILL.md: evals/evals.json, 12 reference guides
Triggers on
Go files (paths: **/*.go). Needs the go tool and govulncheck (installed with go install)
Related skills
7 other skills named in SKILL.md; the README says to install the set together
skills.sh checks
Gen Agent Trust Hub pass, Socket pass, Snyk pass

What it includes

  • Starts at the changed files and traces call sites and data flow into nearby code

    A vulnerability may sit outside the diff but be triggered by it.

    Read · Review mode

  • Up to 5 sub-agents: injection, crypto, web, auth, concurrency and dependencies

    Findings are deduplicated, scored with DREAD and reported by severity. SKILL.md says to apply each fix in its own isolated worktree, one fix per focused PR.

    Runs code · Audit mode

  • Follow the guidance while writing or fixing; can grep for risky patterns meanwhile

    A background agent can scan newly written code for common vulnerability patterns.

    Write · Coding mode

  • Trace the data origin and upstream validation before flagging an issue

    Upstream protection lowers severity but does not dismiss a finding.

    Read · Research before reporting

  • STRIDE per trust boundary; DREAD scoring from Critical (8-10) to Low (1-3.9)

    Reference file references/threat-modeling.md also maps the OWASP Top 10.

    Threat modelling

  • Injection, path traversal (os.Root), timing attacks, crypto and rate limiting fixes

    Each row gives severity, the defence and the standard-library solution.

    Quick reference

  • go get -tool for gosec and govulncheck at @latest, then go tool gosec / govulncheck

    Shown under Tooling and Verification. govulncheck is also listed as the skill's dependency, installed with go install.

    Runs code · gosec and govulncheck

  • go test -race ./... and go test -fuzz=Fuzz

    Run as security tests.

    Runs code · Race and fuzz testing

  • 11 topic guides plus a security review checklist

    Cryptography, injection, filesystem, network, cookies, third-party leaks, memory safety, secrets, logging, threat modelling, architecture, and a checklist.

    Read · Reference guides

From the official docs

Permissions

Medium risk

Claude can change your code, create git worktrees, install Go security tools and fetch web pages. Read the commands it proposes and review each fix before you merge it.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It can fetch web pages and search the web

    WebFetch and WebSearch are in its tool list. Page text enters the conversation, so be careful when a task points at untrusted sites. github.com

  • It installs Go security tools at @latest

    govulncheck and gosec are fetched with go install or go get -tool at @latest. Check git status after a run and pin versions if you need repeatable results. github.com

  • Audit mode can create worktrees and apply fixes

    SKILL.md says to apply each fix in its own git worktree. Review each branch before you merge it. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details
Turning on read-onlyReview mode looks at a diff, but the skill's tool list includes Edit and Write.
Talks togo install and go get -tool fetch govulncheck and gosec at @latest. WebFetch and WebSearch are in the header's tool list
Scopes

  • The SKILL.md header lists these tools: Read, Edit, Write, Glob, Grep, go, govulncheck, golangci-lint, git, sub-agents, WebFetch, WebSearch, AskUserQuestion and the worktree tools

  • Edits Go files in your project

Questions

How do I install golang-security?

Use the install box above. The plugin route installs the whole Go skill set, and the skills CLI route installs only this skill. Pick one so you do not get every skill twice.

What does an audit actually do?

Audit mode scans the whole codebase with up to 5 sub-agents, one per vulnerability domain, then merges and ranks the findings with DREAD. For a large audit, SKILL.md says to apply each fix in its own isolated worktree so every fix is a separate, revertible PR.

Does it need other skills?

It works on its own, but SKILL.md points to 7 other skills in the same repo: golang-continuous-integration, golang-database, golang-dependency-management, golang-lint, golang-observability, golang-pkg-go-dev, golang-safety. The README says installing only a subset gives a partial and potentially inconsistent view, so install the set together.

Does it work in the Claude app, Codex or Cursor?

The SKILL.md header says it is designed for Claude Code, Codex or a similar harness, and the README says the set is built for Claude Code, Codex, Gemini, Copilot, Antigravity and Cursor, with an install section for each. The README does not describe a Claude app install.

Does it need an API key?

SKILL.md names no key. It needs the go tool on your PATH and govulncheck (installed with go install). The skill folder holds SKILL.md, reference guides and an evals file, with no scripts.

Is it safe to use?

It bundles no scripts. Its header lets Claude edit files, run go, govulncheck, golangci-lint and git, create git worktrees, and use WebFetch and WebSearch. It can change your code and fetch pages from the web, so read the commands and diffs it proposes.

golang-security vs golang-safety?

SKILL.md says this skill is not for non-exploitable defensive bugs such as nil panics or slice aliasing. That belongs to golang-safety. It also sends govulncheck dependency scanning to golang-dependency-management and CI scanner wiring to golang-continuous-integration.

Information

updated Nov 2, 2026

Repository
samber/cc-skills-golang
Folder
skills/golang-security

samber/cc-skills-golangskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 8
  1. cc-skills-golang · github.com
  2. cc-skills-golang README · github.com
  3. plugin.json · github.com
  4. skills CLI commands · github.com
  5. README.md#-how-to-use · github.com
  6. golang-security SKILL.md · github.com
  7. threat-modeling.md · github.com
  8. checklist.md · github.com

Updated Nov 2, 2026.