Claude Code, Skill
Cc Skills Golang
🧑🎨 A collection of Golang agentic skills that works
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 8e899e20ff0c, unchanged since the check below.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
skills/golang-security/evals/evals.json, line 423
{"id": "31.5", "text": "If using known_hosts, loads them from a file (e.g., ~/.ssh/known_hosts)"}
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
skills/golang-security/references/injection.md, line 189
cmd := exec.Command("sh", "-c", "rm -f /tmp/"+filename) // DON'T
skills/golang-security/references/injection.md, line 195
cmd := exec.Command("rm", "-f", filepath.Join("/tmp", filename))
skills/golang-testing/references/integration-testing.md, line 103
cmd := exec.Command("docker-compose", "-f", "testdata/docker-compose.yml", "up", "-d")
Show more
skills/golang-testing/references/integration-testing.md, line 124
cmd := exec.Command("docker-compose", "-f", "testdata/docker-compose.yml", "down", "-v")
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach api.example.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
skills/golang-benchmark/references/pprof.md, line 690
curl -o heap.prof http://localhost:6060/debug/pprof/heap
skills/golang-benchmark/references/pprof.md, line 693
curl http://localhost:6060/debug/pprof/goroutine?debug=1
skills/golang-benchmark/references/pprof.md, line 696
curl http://localhost:6060/debug/pprof/goroutine?debug=2
Show more
skills/golang-benchmark/references/pprof.md, line 699
curl http://localhost:6060/debug/pprof/heap?debug=1
skills/golang-benchmark/references/pprof.md, line 815
curl http://localhost:6060/debug/pprof/heap > heap-baseline.prof
skills/golang-benchmark/references/pprof.md, line 820
curl http://localhost:6060/debug/pprof/heap > heap-after.prof
skills/golang-benchmark/references/trace.md, line 65
curl -o trace.out http://localhost:6060/debug/pprof/trace?seconds=5
skills/golang-benchmark/references/trace.md, line 159
curl -o trace.out http://localhost:6060/debug/pprof/trace?seconds=5
skills/golang-concurrency/references/sync-primitives.md, line 308
resp, err := fetch(ctx, url)
skills/golang-context/references/cancellation.md, line 49
func fetch(ctx context.Context) error {
skills/golang-context/references/cancellation.md, line 55
func fetch(ctx context.Context) error {
skills/golang-error-handling/references/error-wrapping.md, line 36
func (r *repo) fetch(id string) error {
skills/golang-error-handling/references/error-wrapping.md, line 42
err := s.repo.fetch(id)
skills/golang-troubleshooting/SKILL.md, line 76
→ curl localhost:6060/debug/pprof/goroutine?debug=2
skills/golang-troubleshooting/references/methodology.md, line 83
curl -v -X POST https://api.example.com/endpoint \
skills/golang-troubleshooting/references/methodology.md, line 97
curl -o /dev/null -s -w "HTTP %{http_code} in %{time_total}s\n" https://api.example.com/health
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
skills/golang-documentation/references/library.md, line 136
// WithBearerToken(os.Getenv("API_TOKEN")),
skills/golang-observability/references/rum.md, line 74
os.Getenv("POSTHOG_API_KEY"),
skills/golang-security/evals/evals.json, line 423
{"id": "31.5", "text": "If using known_hosts, loads them from a file (e.g., ~/.ssh/known_hosts)"}
Show more
skills/golang-observability/references/rum.md, line 135
segmentClient = analytics.New(os.Getenv("SEGMENT_WRITE_KEY"))
skills/golang-security/references/cookies.md, line 174
[]byte(os.Getenv("SESSION_AUTH_KEY")), // Use env var
skills/golang-security/references/cookies.md, line 175
[]byte(os.Getenv("SESSION_ENC_KEY")), // Separate encryption key
skills/golang-security/references/secrets.md, line 57
AWSAccessKey: os.Getenv("AWS_ACCESS_KEY_ID"),
skills/golang-security/references/secrets.md, line 58
AWSSecretKey: os.Getenv("AWS_SECRET_ACCESS_KEY"),
skills/golang-security/references/secrets.md, line 59
DatabasePassword: os.Getenv("DATABASE_PASSWORD"),
skills/golang-security/references/secrets.md, line 169
.env
skills/golang-security/references/secrets.md, line 170
.env.local
skills/golang-security/references/secrets.md, line 171
.env.*.local
skills/golang-project-layout/assets/.gitignore, line 32
# Environment files
skills/golang-project-layout/assets/.gitignore, line 33
.env
skills/golang-project-layout/assets/.gitignore, line 34
.env.local
skills/golang-security/references/secrets.md, line 9
3. `.gitignore` MUST exclude secret files (`.env`, `*.key`, `*.pem`).
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
EVALUATIONS.md, line 1
<!-- prettier-ignore-start -->
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 8e899e20ff0c. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. can reach api.example.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: 8e899e20ff0cd4dc524af3993e4c62d8ee8c5717
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.