| name | golang-dependency-management |
| description | Dependency management strategies for Golang projects — go.mod management, installing/upgrading packages, Minimal Version Selection, vulnerability scanning, outdated dependency tracking, binary size analysis, Dependabot/Renovate setup, conflict resolution, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, auditing vulnerabilities, resolving version conflicts, or setting up automated dependency updates. |
| user-invocable | true |
| license | MIT |
| compatibility | Designed for Claude Code or similar AI coding agents, and for projects using Golang. |
| metadata | {"author":"samber","version":"1.2.4","openclaw":{"emoji":"📦","homepage":"https://github.com/samber/cc-skills-golang","requires":{"bins":["go","govulncheck"]},"install":[{"kind":"go","package":"golang.org/x/vuln/cmd/govulncheck@latest","bins":["govulncheck"]}]}} |
| allowed-tools | Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent Bash(govulncheck:*) AskUserQuestion |
Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.
Dependencies:
- govulncheck:
go install golang.org/x/vuln/cmd/govulncheck@latest
Go Dependency Management
AI Agent Rule: Ask Before Adding Dependencies
Before running go get to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using go get -u to upgrade an existing dependency is safe.
Before proposing a dependency, evaluate:
- Does the standard library already cover the use case?
- Is the license compatible?
- Are there well-known alternatives?
- What it does and why it's needed?
The samber/cc-skills-golang@golang-popular-libraries skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (golang.org/x/...) or established organizations over obscure alternatives.
Key Rules
go.sum MUST be committed — it records cryptographic checksums of every dependency version, letting go mod verify detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious codegovulncheck ./... or go tool govulncheck ./... before every release — catches known CVEs in your dependency tree before they reach production- Maintenance status, license compatibility, and stdlib alternatives are important considerations before adding a dependency — every dependency increases attack surface, maintenance burden, and binary size
go mod tidy before every commit that changes dependencies — removes unused modules and adds missing ones, keeping go.mod honest
go.mod & go.sum
Essential Commands
| Command | Purpose |
|---|
go mod tidy | Add missing deps, remove unused ones |
go mod download | Download modules to local cache |
