Menu
Run gosec and govulncheck to find security vulnerabilities. Use before releases or after dependency changes.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
| name | security-scan |
| description | Run gosec and govulncheck to find security vulnerabilities. Use before releases or after dependency changes. |
| disable-model-invocation | true |
| argument-hint | package-path |
Run Go security scanners to find vulnerabilities in code and dependencies.
/security-scan - Full scan (gosec + govulncheck)/security-scan ./internal/api/... - Scan specific package with gosecRun gosec (static analysis)
gosec -exclude-generated -exclude-dir=internal/codesearch $ARGUMENTS 2>&1
If no arguments provided:
gosec -exclude-generated -exclude-dir=internal/codesearch ./... 2>&1
If gosec is not installed:
go install github.com/securego/gosec/v2/cmd/gosec@latest
Run govulncheck (dependency vulnerabilities)
govulncheck ./... 2>&1
If govulncheck is not installed:
go install golang.org/x/vuln/cmd/govulncheck@latest
Report findings
## Security Scan Results
### gosec (Code Analysis)
| Severity | File | Line | Issue |
|----------|------|------|-------|
### govulncheck (Dependencies)
| Module | Vulnerability | Severity | Fixed In |
|--------|--------------|----------|----------|
### Summary
- Code issues: N (high: N, medium: N, low: N)
- Vulnerable dependencies: N
For each finding, suggest a specific fix or mitigation.
The CI pipeline runs:
gosec -exclude-generated -exclude-dir=internal/codesearch ./...
A separate vulnerability.yml workflow checks for dependency vulnerabilities.
Running /security-scan locally catches both before pushing.
| Rule | Description | Common Fix |
|---|---|---|
| G101 | Hardcoded credentials | Use env vars |
| G104 | Unhandled errors | Add error checks |
| G304 | File path from variable | Validate/sanitize path |
| G401 | Weak crypto (MD5/SHA1) | Use SHA-256+ |
| G501 | Insecure TLS | Use TLS 1.2+ |
Run Go benchmarks and compare results to detect performance regressions. Use before and after performance-related changes.
Run pre-push quality checks (vet + lint + tests with race detector). Use before pushing code.
Run tests with coverage analysis and identify untested code paths. Use to find gaps before releases.
Check and tidy Go module dependencies. Use after adding/removing imports or before releases.
Run go generate to build templ templates and frontend assets. Use after changing templates or CSS/JS.
Run integration tests that require Docker (Postgres, MinIO via testcontainers). Use to validate database and storage behavior.