How do I install the Code Review Go skill?

Run npx skillmds@latest add noorqureshi/code-review-go in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Review Go safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Review Go?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Review Go free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Code Review Go?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Review Go by noorqureshi — Agent Skill

Name: Code Review Go
Author: NoorQureshi

Code Review Go

Security review of Go code — dangerous sinks and web-framework pitfalls. Load when reviewing a Go codebase/PR, on .go source in scope, or "review this Go". Signals: go.mod, net/http, os/exec, text/template, database/sql, gin/echo/fiber.

NoorQureshi 6dba4b6 2.6 KB Updated Sep 17, 2026

File contents

Go source review

When it applies

Reviewing Go source (an API, a CLI, a microservice). Go is memory-safe, so the bugs are logic and injection: command exec, the wrong template package, string-built SQL, and path/SSRF handling.

Why it works

Go's stdlib gives a safe and an unsafe option side by side (html/template vs text/template; parameterised db.Query(?, x) vs fmt.Sprintf into a query). Reviews find code that reached for the unsafe one, or that shells out with sh -c.

Sinks & patterns (grep, then trace to user input)

Command exec: exec.Command("sh","-c", …) / exec.CommandContext with concatenated input (safe form passes args separately — flag the sh -c variant).
XSS: text/template used to render HTML (no auto-escaping); manual w.Write([]byte(userHTML)).
SQLi: fmt.Sprintf/string concat into db.Query/db.Exec instead of placeholders.
Path traversal: filepath.Join(base, userInput) without filepath.Clean + prefix check; http.ServeFile with user paths.
SSRF: http.Get/http.NewRequest on user-supplied URLs; missing host allowlist.
Other: text/template/html/template injection from user-controlled template strings, unvalidated Unmarshal into structs (mass assignment), unsafe pointer use, weak math/rand for tokens (use crypto/rand).

Framework specifics

gin/echo/fiber: c.Param/c.Query/c.Bind sources; check bound structs for mass assignment and missing auth middleware on state-changing routes.
Templates: confirm html/template (not text/template) for anything rendered to a browser.

Method

Run gosec and govulncheck for a first pass; treat as leads, not verdicts.
rg 'exec.Command|text/template|Sprintf.*Query|filepath.Join' and trace to request input.
Check auth/authorization middleware coverage on each route group.
Confirm exploitable classes with the matching runtime skill.

Gotchas

exec.Command(name, arg1, arg2) (no shell) is safe — only the sh -c "...user..." form injects.
html/template context-escapes; the bug is usually using text/template by mistake.
Errors ignored with _ can hide security-relevant failures (e.g. an auth check's error).

References

Go security best practices; gosec rule set; OWASP Go SCP; govulncheck (known-vuln deps).

---name: code-review-godescription: Security review of Go code — dangerous sinks and web-framework pitfalls. Load when reviewing a Go codebase/PR, on .go source in scope, or "review this Go". Signals: go.mod, net/http, os/exec, text/template, database/sql, gin/echo/fiber.---# Go source review## When it appliesReviewing Go source (an API, a CLI, a microservice). Go is memory-safe, so the bugs are logic andinjection: command exec, the wrong template package, string-built SQL, and path/SSRF handling.## Why it worksGo's stdlib gives a safe and an unsafe option side by side (`html/template` vs `text/template`;parameterised `db.Query(?, x)` vs `fmt.Sprintf` into a query). Reviews find code that reached for theunsafe one, or that shells out with `sh -c`.## Sinks & patterns (grep, then trace to user input)- **Command exec**: `exec.Command("sh","-c", …)` / `exec.CommandContext` with concatenated input (safe form passes args separately — flag the `sh -c` variant).- **XSS**: `text/template` used to render HTML (no auto-escaping); manual `w.Write([]byte(userHTML))`.- **SQLi**: `fmt.Sprintf`/string concat into `db.Query`/`db.Exec` instead of placeholders.- **Path traversal**: `filepath.Join(base, userInput)` without `filepath.Clean` + prefix check; `http.ServeFile` with user paths.- **SSRF**: `http.Get`/`http.NewRequest` on user-supplied URLs; missing host allowlist.- **Other**: `text/template`/`html/template` injection from user-controlled template strings, unvalidated `Unmarshal` into structs (mass assignment), `unsafe` pointer use, weak `math/rand` for tokens (use `crypto/rand`).## Framework specifics- **gin/echo/fiber**: `c.Param`/`c.Query`/`c.Bind` sources; check bound structs for mass assignment and missing auth middleware on state-changing routes.- **Templates**: confirm `html/template` (not `text/template`) for anything rendered to a browser.## Method1. Run `gosec` and `govulncheck` for a first pass; treat as leads, not verdicts.2. `rg 'exec.Command|text/template|Sprintf.*Query|filepath.Join'` and trace to request input.3. Check auth/authorization middleware coverage on each route group.4. Confirm exploitable classes with the matching runtime skill.## Gotchas- `exec.Command(name, arg1, arg2)` (no shell) is safe — only the `sh -c "...user..."` form injects.- `html/template` context-escapes; the bug is usually using `text/template` by mistake.- Errors ignored with `_` can hide security-relevant failures (e.g. an auth check's error).## ReferencesGo security best practices; `gosec` rule set; OWASP Go SCP; `govulncheck` (known-vuln deps).

Frequently asked questions