asdf-go-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited asdf-go-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Install gopls into the right location for a project's asdf-managed Go version.
asdf's golang plugin only scans bin/ and go/bin/ inside an install (via list-bin-paths). gopls must live at:
$ASDF_DIR/installs/golang/<version>/bin/goplsgo install without an explicit GOBIN puts the binary in $GOPATH/bin (packages/bin/), which asdf never finds. The fix is to set both GOBIN and GOPATH explicitly.
Use args if provided; default to the current working directory.
Check in order, stopping at the first match:
<path>/.tool-versions — look for a line starting with golang <path>/go.mod — read the go directive (e.g. go 1.22.12)~/.tool-versions — global asdf fallbackIf no version is found anywhere, report the gap and stop. Do not guess.
# From .tool-versions
grep '^golang ' <path>/.tool-versions | awk '{print $2}'
# From go.mod
grep '^go ' <path>/go.mod | awk '{print $2}'echo "${ASDF_DIR:-$HOME/.asdf}"asdf list golang | grep -F "<version>"If missing, tell the user to run asdf install golang <version> and stop.
ls "$ASDF_DIR/installs/golang/<version>/bin/gopls" 2>/dev/nullIf the binary exists, skip to step 7.
Use the Go binary for that exact version so the module cache stays isolated:
GOBIN="$ASDF_DIR/installs/golang/<version>/bin" \
GOPATH="$ASDF_DIR/installs/golang/<version>/packages" \
"$ASDF_DIR/installs/golang/<version>/go/bin/go" install \
golang.org/x/tools/gopls@latestNote: gopls >= v0.22 requires Go >= 1.26. If the project version is older, Go will auto-switch via GOTOOLCHAIN to a newer installed version. This is expected and harmless — the binary still lands in the project version's bin/ directory.
Then reshim:
asdf reshim golang <version>Run this from inside the project path:
cd <path> && asdf which goplsExpected output: $ASDF_DIR/installs/golang/<version>/bin/gopls
If it still fails, check that <path>/.tool-versions contains golang <version> — the shim uses that file to resolve which version to serve.
Tell the user:
asdf which gopls~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.