One db.Query(fmt.Sprintf("... '%s'", name)) or one InsecureSkipVerify: true is enough to lose your data. This skill finds those and nine other Go security mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your .go files. It skips comments, understands Go strings (including raw strings), follows SQL built in a variable to the call that runs it, and knows which values come from the request (FormValue, URL queries, gin, echo and chi parameters). It knows the safe patterns: placeholders ($1, ?), fixed strings, filepath.Base and crypto/rand. Generated files are skipped. It never runs Go. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• G01: SQL built with fmt.Sprintf or + and passed to Query, Exec, sqlx or GORM Raw and Where

• G02: exec.Command running a shell with a command that is not a fixed string

• G03: a hard-coded secret, password, API key or JWT signing key

• G04: the JWT none algorithm allowed

REVIEW (check before release)

• G11: InsecureSkipVerify: true

• G12: math/rand used for tokens, secrets, OTPs or salts

• G13: md5, sha1 or sha256 on passwords

• G14: http.ListenAndServe or an http.Server without timeouts

• G15: file paths from the request in os.Open, ServeFile and similar

• G16: net/http/pprof imported

• G17: CORS that allows every origin together with credentials

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example Go service, and the real report the scanner produces on the risky one

Limits

It reads code as text, not as the Go type checker: values are followed within one file. Dependencies, known CVEs (use govulncheck) and data flow across packages are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 12 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (6 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.