Menu
Run gosec and govulncheck to find security vulnerabilities. Use before releases or after dependency changes.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | security-scan |
| description | Run gosec and govulncheck to find security vulnerabilities. Use before releases or after dependency changes. |
| disable-model-invocation | true |
| argument-hint | package-path |
Run Go security scanners to find vulnerabilities in code and dependencies.
/security-scan - Full scan (gosec + govulncheck)/security-scan ./internal/api/... - Scan specific package with gosecRun gosec (static analysis)
gosec -exclude-generated -exclude-dir=internal/codesearch $ARGUMENTS 2>&1
If no arguments provided:
gosec -exclude-generated -exclude-dir=internal/codesearch ./... 2>&1
If gosec is not installed:
go install github.com/securego/gosec/v2/cmd/gosec@latest
Run govulncheck (dependency vulnerabilities)
govulncheck ./... 2>&1
If govulncheck is not installed:
go install golang.org/x/vuln/cmd/govulncheck@latest
Report findings
## Security Scan Results
### gosec (Code Analysis)
| Severity | File | Line | Issue |
|----------|------|------|-------|
### govulncheck (Dependencies)
| Module | Vulnerability | Severity | Fixed In |
|--------|--------------|----------|----------|
### Summary
- Code issues: N (high: N, medium: N, low: N)
- Vulnerable dependencies: N
For each finding, suggest a specific fix or mitigation.
The CI pipeline runs:
gosec -exclude-generated -exclude-dir=internal/codesearch ./...
A separate vulnerability.yml workflow checks for dependency vulnerabilities.
Running /security-scan locally catches both before pushing.
| Rule | Description | Common Fix |
|---|---|---|
| G101 | Hardcoded credentials | Use env vars |
| G104 | Unhandled errors | Add error checks |
| G304 | File path from variable | Validate/sanitize path |
| G401 | Weak crypto (MD5/SHA1) | Use SHA-256+ |
| G501 | Insecure TLS | Use TLS 1.2+ |
Run Go benchmarks and compare results to detect performance regressions. Use before and after performance-related changes.
Run pre-push quality checks (vet + lint + tests with race detector). Use before pushing code.
Run tests with coverage analysis and identify untested code paths. Use to find gaps before releases.
Check and tidy Go module dependencies. Use after adding/removing imports or before releases.
Run go generate to build templ templates and frontend assets. Use after changing templates or CSS/JS.
Run integration tests that require Docker (Postgres, MinIO via testcontainers). Use to validate database and storage behavior.