메뉴
Run gosec and govulncheck to find security vulnerabilities. Use before releases or after dependency changes.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Run Go benchmarks and compare results to detect performance regressions. Use before and after performance-related changes.
Run pre-push quality checks (vet + lint + tests with race detector). Use before pushing code.
Run tests with coverage analysis and identify untested code paths. Use to find gaps before releases.
Check and tidy Go module dependencies. Use after adding/removing imports or before releases.
Run go generate to build templ templates and frontend assets. Use after changing templates or CSS/JS.
Run integration tests that require Docker (Postgres, MinIO via testcontainers). Use to validate database and storage behavior.
| name | security-scan |
| description | Run gosec and govulncheck to find security vulnerabilities. Use before releases or after dependency changes. |
| disable-model-invocation | true |
| argument-hint | package-path |
Run Go security scanners to find vulnerabilities in code and dependencies.
/security-scan - Full scan (gosec + govulncheck)/security-scan ./internal/api/... - Scan specific package with gosecRun gosec (static analysis)
gosec -exclude-generated -exclude-dir=internal/codesearch $ARGUMENTS 2>&1
If no arguments provided:
gosec -exclude-generated -exclude-dir=internal/codesearch ./... 2>&1
If gosec is not installed:
go install github.com/securego/gosec/v2/cmd/gosec@latest
Run govulncheck (dependency vulnerabilities)
govulncheck ./... 2>&1
If govulncheck is not installed:
go install golang.org/x/vuln/cmd/govulncheck@latest
Report findings
## Security Scan Results
### gosec (Code Analysis)
| Severity | File | Line | Issue |
|----------|------|------|-------|
### govulncheck (Dependencies)
| Module | Vulnerability | Severity | Fixed In |
|--------|--------------|----------|----------|
### Summary
- Code issues: N (high: N, medium: N, low: N)
- Vulnerable dependencies: N
For each finding, suggest a specific fix or mitigation.
The CI pipeline runs:
gosec -exclude-generated -exclude-dir=internal/codesearch ./...
A separate vulnerability.yml workflow checks for dependency vulnerabilities.
Running /security-scan locally catches both before pushing.
| Rule | Description | Common Fix |
|---|---|---|
| G101 | Hardcoded credentials | Use env vars |
| G104 | Unhandled errors | Add error checks |
| G304 | File path from variable | Validate/sanitize path |
| G401 | Weak crypto (MD5/SHA1) | Use SHA-256+ |
| G501 | Insecure TLS | Use TLS 1.2+ |