go-surgeon-scaffold — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-surgeon-scaffold (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are working in a Go project that has go-surgeon scaffolding templates available. Before creating files manually, ALWAYS check if a template exists that can do it better.
The scaffold system is a workflow engine — not just a file generator. Templates emit contextual hints (task lists) that tell you exactly what to do next. You MUST read and follow these hints.
# Check if templates exist
go-surgeon scaffold list-templates
# If no templates found, .surgeon-templates/ doesn't exist yet — skip scaffoldinggo-surgeon scaffold list-templatesReturns all templates with their names, descriptions, and available commands.
# All commands in a template
go-surgeon scaffold doc <template_name>
# Specific command (shows required variables, files generated, hints)
go-surgeon scaffold doc <template_name> <command_name>Always read the doc before executing. It tells you:
--set Key=Value)post_commands will chain automaticallygo-surgeon scaffold execute <template> <command> --set Key=Value [--set Key2=Value2 ...]# Step 1: Read what bootstrap does
go-surgeon scaffold doc hexagonal bootstrap
# Step 2: Execute with required variables
go-surgeon scaffold execute hexagonal bootstrap \
--set AppName=catalog \
--set ModulePath=github.com/myorg/myapptext/template syntax and your variables.post_commands, they execute automatically in sequence. Variables are forwarded. Diamond dependencies are deduplicated (a command never runs twice in the same chain)..go files are formatted with goimports automatically.After every scaffold execution, hints are printed to the console. They look like:
--- bootstrap ---
Project bootstrapped. The following commands were executed in sequence.
--- add_main ---
Main created at cmd/catalog/main.go.
--- add_domain ---
Domain layer initialized at internal/catalog/domain/.
You MUST now:
1. Define your domain entities using `go-surgeon add-struct`
2. Create repositories using: go-surgeon scaffold execute hexagonal add_repository --set AppName=catalog --set EntityName=Book
3. Wire the application in cmd/catalog/main.goYou MUST follow these hints step by step. They are the template author's designed workflow. Do not improvise a different approach.
When a hint tells you to run another scaffold command, run it. When it tells you to use go-surgeon add-struct or go-surgeon update-func, switch to using those commands (see the go-surgeon-edit skill).
Variables are passed via --set Key=Value flags. They're available in templates as {{ .Key }}.
{{ .AppName | lower }} — lowercase{{ .AppName | upper }} — UPPERCASE{{ .AppName | title }} — Title CaseVariables are used in:
.tmpl files)cmd/{{ .AppName }}/main.go)internal/{{ .AppName }}/domain/")If no template exists for what the user wants, and they'd benefit from a reusable pattern, you can create one.
Templates live in .surgeon-templates/<name>/manifest.yaml:
name: hexagonal
description: |
Hexagonal architecture template for Go services.
commands:
- command: bootstrap
description: Bootstraps a complete hexagonal project structure
variables:
- key: AppName
description: folder name for the main app
- key: ModulePath
description: Go module path
files:
- source: .gitignore.tmpl
destination: .gitignore
- source: Makefile.tmpl
destination: Makefile
post_commands:
- add_main
hint: |
Project bootstrapped successfully.
- command: add_main
description: Creates the main.go entrypoint
variables:
- key: AppName
description: folder name for the main app
files:
- source: cmd/appname/main.go.tmpl
destination: cmd/{{ .AppName }}/main.go
hint: |
Main created at cmd/{{ .AppName }}/main.go.
Next: define domain entities and repositories.add_repository, add_usecase, add_http_handler) rather than one massive generator.bootstrap → add_main → add_domain runs in one shot.{{ .EntityName | lower }} in destination paths for dynamic directory creation.source to create an empty file (useful for .gitkeep or placeholder packages)..surgeon-templates/
└── hexagonal/
├── manifest.yaml
├── .gitignore.tmpl
├── Makefile.tmpl
└── cmd/
└── appname/
└── main.go.tmplTemplate files use Go text/template syntax:
// main.go.tmpl
package main
func main() {
app := {{ .AppName | lower }}.NewApp()
app.Run()
}When the user asks to create something in a Go project:
1. Is go-surgeon available?
NO → Fall back to manual file creation
YES → Continue
2. Does the task involve creating multiple related files / architectural layers?
NO → Use go-surgeon edit commands directly (add-func, add-struct, etc.)
YES → Continue
3. Run: go-surgeon scaffold list-templates
Templates exist?
NO → Either create a template (if reusable) or use edit commands
YES → Continue
4. Read: go-surgeon scaffold doc <template> <command>
Command matches the need?
YES → Execute it and follow hints
NO → Use edit commands or create a new template commandgo-surgeon scaffold doc hexagonal bootstrap
go-surgeon scaffold execute hexagonal bootstrap --set AppName=catalog --set ModulePath=github.com/myorg/catalog
# → Follow hints to add entities, repos, handlersgo-surgeon scaffold doc hexagonal add_entity
go-surgeon scaffold execute hexagonal add_entity --set AppName=catalog --set EntityName=Book
# → Follow hints to define fields, create repository, wire in appgo-surgeon scaffold doc hexagonal add_repository
go-surgeon scaffold execute hexagonal add_repository --set AppName=catalog --set EntityName=Book
# → Follow hints to implement the adapterEach scaffold execution produces hints → you follow them → some hints say to run another scaffold → you run it → it produces more hints → repeat until the architecture is complete.
This is the power of the scaffold workflow engine: the template author designs the entire build sequence, and you just follow the hints.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.