go-packages — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-packages (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
references/IMPORTS.md - Read when grouping imports, using blank imports, dot imports, or import aliases.references/PACKAGE-SIZE.md - Read when splitting packages, avoiding init, structuring main, or designing CLI flags/subcommands.When this skill does NOT apply: For naming individual identifiers within a package, see go-naming. For organizing functions within a single file, see go-functions. For configuring linters that enforce import rules, see go-linting.
Package names should describe what the package provides. Avoid generic names like util, helper, common — they obscure meaning and cause import conflicts.
// Good: Meaningful package names
db := spannertest.NewDatabaseFromFile(...)
_, err := f.Seek(0, io.SeekStart)
// Bad: Vague names obscure meaning
db := test.NewDatabaseFromFile(...)
_, err := f.Seek(0, common.SeekStart)Generic names can be used as part of a name (e.g., stringutil) but should not be the entire package name.
| Question | Action |
|---|---|
| Can you describe its purpose in one sentence? | No → split by responsibility |
| Do files never share unexported symbols? | Those files could be separate packages |
| Distinct user groups use different parts? | Split along user boundaries |
| Godoc page overwhelming? | Split to improve discoverability |
Do NOT split just because a file is long, to create single-type packages, or if it would create circular dependencies.
Imports are organized in groups separated by blank lines. Standard library packages always come first. Use goimports to manage this automatically.
import (
"fmt"
"os"
"github.com/foo/bar"
"rsc.io/goversion/version"
)Quick rules:
| Rule | Guidance |
|---|---|
| Grouping | stdlib first, then external. Extended: stdlib → other → protos → side-effects |
| Renaming | Avoid unless collision. Rename the most local import. Proto packages get pb suffix |
Blank imports (import _) | Only in main packages or tests |
Dot imports (import .) | Never use, except for circular-dependency test files |
Avoid init() where possible. When unavoidable, it must be:
init() orderingAcceptable uses: complex expressions that can't be single assignments, pluggable hooks (e.g., database/sql dialects), deterministic precomputation.
Call os.Exit or log.Fatal* only in `main()`. All other functions should return errors.
Why: Non-obvious control flow, untestable, defer statements skipped.
Best practice: Use the run() pattern — extract logic into func run() error, call from main() with a single exit point:
func main() {
if err := run(); err != nil {
log.Fatal(err)
}
}Advisory: Define flags only in package main.snake_case: --output_dir not --outputDirthis keeps them testable and reusable
flag package; use pflag only when POSIX conventions(double-dash, single-char shortcuts) are required
// Good: Flag in main, passed as parameter to library
func main() {
outputDir := flag.String("output_dir", ".", "directory for output files")
flag.Parse()
if err := mylib.Generate(*outputDir); err != nil {
log.Fatal(err)
}
}%w vs %vinit() with explicit initialization or avoiding mutable globals~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.