Golang security

Skill ComeOnOliver/skillshub/skills/HoangNguyen0403/agent-skills-standard/golang-security

🧠 The right skill, one API call. AI agent skills registry with token-efficient skill resolution. 5,000+ skills from 500+ top repos.

Install

npx -y skills add ComeOnOliver/skillshub --skill golang-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Security standards for Go backend services. Use when implementing input validation, crypto, or SQL injection prevention in Go. (triggers: crypto/rand, argon2, sanitize, jwt, bcrypt, validation, input validation, sql injection)

SKILL.md

2.0 KB, 444 tokens by cl100k_base, as published. Nobody here has run it

Golang Security Standards

Priority: P0 (CRITICAL)

Implementation Guidelines

Input Validation

Validation: Use go-playground/validator or google/go-cmp for struct validation.
Sanitization: Sanitize user input before processing. Use bluemonday for HTML sanitization.

Cryptography

Random: ALWAYS use crypto/rand, NEVER math/rand for security-sensitive operations (tokens, keys, IVs).
Hashing: Use Argon2id for password hashing (golang.org/x/crypto/argon2). Do NOT use bcrypt (weaker) or MD5/SHA1 (insecure). Recommended params: time=1, memory=64MB, threads=4.
Encryption: Use crypto/aes with GCM mode for authenticated encryption.

SQL Injection Prevention

Parameterized Queries: ALWAYS use $1, $2 placeholders with database/sql or ORM (GORM, sqlx).
No String Concatenation: Never build queries with fmt.Sprintf().

Authentication

JWT: Use golang-jwt/jwt v5+. Enforce RS256 (preferred) or HS256. Reject none and symmetric algorithms for multi-service auth. Validate alg, iss, aud, exp claims.
Sessions: Use secure, httpOnly cookies with gorilla/sessions.

Secret Management

Environment Variables: Load secrets via godotenv or Kubernetes secrets.
No Hardcoding: Never commit API keys, passwords, or tokens to Git.

Anti-Patterns

No math/rand for Security: RNG is predictable. Use crypto/rand.
No fmt.Sprintf() for SQL: Causes SQL injection. Use placeholders.
No bcrypt or MD5 for Passwords: Use argon2id exclusively.
No Exposed Error Details: Don't leak stack traces to clients in production.

References

Implementation Examples