go-debugger — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-debugger (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Random fixes waste tokens and create new bugs. This skill enforces root cause investigation before any fix attempt, adapted to Go hexagonal codebases.
NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRSTIf you haven't completed Phase 1, you cannot propose fixes. If you haven't traced the error through the hexagonal layers, you don't understand it.
-raceUse ESPECIALLY when:
Don't skip past errors. Go errors wrap context at each layer — read the full chain:
create notification: find project by id: dial tcp: connection refusedThis tells you: app layer (create notification) → repository call (find project by id) → infrastructure (dial tcp: connection refused). The root cause is infrastructure, not domain logic.
In hexagonal architecture, the error originates in one of these layers:
| Layer | Symptoms | Where to Look |
|---|---|---|
| Domain | Validation errors, business rule violations | internal/*/domain/ |
| App | Orchestration failures, wrong service wiring | internal/*/app/ |
| Outbound | DB errors, queue errors, cache misses | internal/*/outbound/ |
| Inbound | Wrong HTTP status, malformed response, routing | internal/*/inbound/ |
| Infrastructure | Connection failures, migration errors, testcontainer | cmd/, docker-compose, migrations |
| Test | Wrong assertion, bad test data, mock not wired | *_test.go, *test/contract.go |
Trace inward: start from the error surface (test output, HTTP response) and trace through inbound → app → domain → outbound until you find the originating layer.
# Run the specific failing test with verbose output and race detection
go test ./internal/<context>/... -run TestSpecificName -count=1 -v -raceIf it's intermittent:
-count=10 to reproduce race conditions# What changed since the last green state?
git diff HEAD~1 --name-only
git log --oneline -5Focus on:
For multi-layer failures, add temporary diagnostic logging at each boundary:
// Temporary — remove after debugging
log.Printf("DEBUG [inbound] request: %+v", req)
log.Printf("DEBUG [app] calling repo with projectID=%s entityID=%s", projectID, entityID)
log.Printf("DEBUG [outbound] SQL result rows=%d err=%v", rows, err)Run once. Read the output. Identify WHERE the data goes wrong. Remove the logging.
In hexagonal codebases, similar patterns repeat. Find an entity that works correctly with the same pattern:
# Find similar repository methods
grep -r "FindByID" internal/*/domain/repositories/ --include="*.go"
# Find similar test patterns
grep -r "TestCreate" internal/*/outbound/ --include="*_test.go"Compare the broken code against the working example:
Common hexagonal debugging patterns:
| Issue | Likely Cause | Check |
|---|---|---|
nil pointer in handler | Service interface not injected | init.go or main.go wiring |
called not defined XxxFunc | Mock not configured in test | Test setup function |
| Wrong HTTP status code | Converter or error mapping wrong | inbound/handlers/ error switch |
| Entity not found (but exists) | Missing scope filter in query | outbound/ SQL WHERE clause |
| Migration fails on re-run | Non-idempotent DDL | Missing IF NOT EXISTS |
| Test passes alone, fails in suite | Shared test state | TestMain setup/teardown |
State it clearly:
HYPOTHESIS: The FindByID query in outbound/pg/notification_repository.go
filters by notification_id only, missing the project_id scope filter.
This causes the e2e IDOR test to pass (finding the entity across scopes)
when it should return not-found.Make the SMALLEST possible change to test the hypothesis. ONE variable at a time.
Do NOT:
go build ./...
go test ./internal/<context>/... -count=1 -v -raceUse TDD even for bugfixes:
func TestNotification_FindByID_WrongProject_ReturnsNotFound(t *testing.T) {
// Create notification in project A
// Attempt to find it from project B
// Assert: domain.ErrNotificationNotFound
}Run it. Confirm it fails for the right reason.
ONE change. At the source, not at the symptom.
go build ./...
go test ./... -count=1 -race # Full suite, not just the failing test| Attempts | Action |
|---|---|
| 1 fix failed | Re-analyze with new information. Return to Phase 1. |
| 2 fixes failed | Step back. Are you in the right layer? Re-trace from the error surface. |
| 3+ fixes failed | STOP. This is likely an architectural issue, not a local bug. Report to user with: what you investigated, what you tried, why you think the architecture needs discussion. |
When done, return:
## Debug Report
### Root Cause
[One sentence: what was actually wrong and in which layer]
### Evidence
[The specific error trace or test output that confirmed the root cause]
### Fix
- `path/to/file.go` — [what changed]
### Verification
- go build: PASS
- go test (specific): PASS
- go test (full suite): PASS
- Race detector: CLEAN
### Regression Test
- `path/to/test_file.go:TestName` — [what it proves]~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.