Self-hosted alternatives to golang-security

G

golang-security

Security best practices and vulnerability prevention for Golang

golang-security is an agent skill from the samber cc-skills-golang collection that brings security practice to Go code. It covers vulnerability prevention for injection, including SQL, command and cross-site scripting injection, as well as cryptography, path traversal, server-side request forgery, HTTP security headers and related areas. The skill is meant to apply security thinking while writing new code and when auditing existing code. It has three modes. Review mode checks a pull request, starting from the changed files and tracing call sites and data flows into code the diff touches. Audit mode runs up to five sub-agents in parallel, each covering one domain: injection, cryptography and secrets, web security and headers, authentication and authorisation, and concurrency safety and dependency vulnerabilities. Its findings are combined, scored with DREAD and reported by severity, and each fix is suggested as its own focused change. Coding mode applies the guidance while writing or fixing code. The skill expects the govulncheck tool, installed with go install golang.org/x/vuln/cmd/govulncheck@latest. It is listed on skills.sh, where the page shows install counts, GitHub stars and security audit results, all passing. Install it with npx skills add https://github.com/samber/cc-skills-golang --skill golang-security.