# Static Analysis

> Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps.

- Skill: `pilinux/static-analysis` (Agent Skill)
- Install (CLI): `npx skillmds@latest add pilinux/static-analysis`
- Raw SKILL.md: https://api.skillmd.com/api/skills/pilinux/static-analysis/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: pilinux (https://skillmd.com/u/pilinux)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/pilinux/static-analysis

---


# Static Analysis

## When to Use

- Security or correctness checks are requested, or to reproduce CI static-analysis failures locally.

## Rules

- Use repository-standard tooling where configured.
- Summarize findings by severity and provide minimal remediation steps.
- Avoid suppressing issues unless instructed.

## Commands

- `go vet -v ./...`
- `gosec ./...`
- `govulncheck ./...`

## Cross-Platform Vet

CI runs vet on six OS/arch combos. Key examples:

- `GOOS=linux GOARCH=amd64 go vet -v ./...`
- `GOOS=darwin GOARCH=arm64 go vet -v ./...`
- `GOOS=windows GOARCH=amd64 go vet -v ./...`

## Output

- Findings grouped by tool and severity.
- For each: `path:line`, plain-language meaning, and a minimal fix suggestion.
- Verification: commands to re-run the specific tool.

## Related Skills

- `linter-runner`, `ci-orchestrator`