---
name: "gosec-golang-security-scanner"
description: "Audit Go source code for security flaws, unsafe pointers, and weak cryptography."
metadata:
  author: "SecureGo"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run gosec security scan"
  - "fix golang sql injection gosec"
  - "audit go tls config"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# GoSec Golang Security AST Analyzer

Scans Go source trees with gosec: detecting SQL injection, hardcoded credentials, integer overflows, directory traversal, and TLS configuration misconfigurations.

## When to Invoke
Invoke this skill whenever you need to:
- run gosec security scan
- fix golang sql injection gosec
- audit go tls config

## Execution SOP & Rules
1. Execute gosec -quiet -fmt=json -out=results.json ./... in project root.
2. Prevent SQL injection by using database/sql parameterized placeholders ($1 or ?).
3. Verify file operations prevent path traversal by validating paths against workspace boundaries.
4. Ensure cryptographic operations utilize crypto/rand rather than math/rand.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.