go-code-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-code-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A repeatable, opinionated review pass for Go code. Read the diff file by file, walk each topic in order, flag findings with file:line references, then group by severity.
gofmt, go vet, and golangci-lint are clean. They free your attention for what tools cannot catch.file:line plus the rule name (go-naming: initialisms) — never a bare opinion.gofmt -d ./..., go vet ./..., golangci-lint run ./..., go test ./... -race -short.file:line and the rule name that justifies it.Use references/review-template.md when writing up the review for consistent severity grouping and tone.
gofmt -l ./... && go vet ./... && golangci-lint run ./... && go test ./... -race -shortFix anything the tools find before continuing. See go-linting for setup.
gofmt/goimports clean; long lines break by semantics, not column count.); package comment adjacent to package clause; non-trivial unexported have intent comments; named returns only when they clarifySee go-documentation.
_ = f()) without a written justification%w when the caller may want to inspect; %v only when hiding is deliberate-1, "", nil) for failure — multi-return with an error or ok boolSee go-error-handling.
MixedCaps / mixedCaps only — no underscores or SCREAMING_SNAKEURL, ID, HTTP, XMLHTTPRequest, serveHTTPi, r, ctx); longer names for wider scopesthis/self/mehttp.Server, not http.HTTPServer)util, helpers, common, misclen, error, cap, new, make, copy, any)See go-naming and go-packages.
var/const/type are in grouped blocks; unrelated kept separatevar for intentional zero values; := for computed localsiota + 1 (or zero is explicitly meaningful)any instead of interface{} in new codeSee go-declarations.
else after a returning/breaking/continuing if; no := shadowing of outer ctx/err; map iteration is order-agnostic; labeled break/continue for switch-in-loopSee go-control-flow.
fSee go-functions.
var _ I = (*T)(nil) on exported implementationsSee go-interfaces.
ctx.Done() or documented); APIs synchronous by default; context.Context first param, never struct field; lock order documented; sender closes channelsExample to flag (pkg/worker/worker.go:42):
go s.process(req) // ✗ no ctx, no done signal — leak on shutdownvs. acceptable:
s.wg.Add(1)
go func() { defer s.wg.Done(); s.process(ctx, req) }()See go-concurrency.
var t []T for nil slices, []T{} only when empty non-nil is required (JSON output); copies of structs containing sync.Mutex flagged; slice/map at API boundaries copied or borrowing documentedSee go-data-structures.
crypto/rand for secret material (never math/rand); no library panic for ordinary failureslog/slog (not log/fmt.Println); static message + structured attrs; secrets and PII never loggedSee go-defensive and go-logging.
main/tests; no dot importsSee go-packages.
See go-generics.
httptest.NewServer over hand-rolled mocks; TestMain only when truly necessary; Example* for non-trivial APIsRead references/integrative-example.md to see the rules applied together on a small HTTP server.
>
Read references/severity-rubric.md when deciding whether to label a finding must-fix, should-fix, or nit.
| Severity | Examples |
|---|---|
| Must Fix | Race, security bug, swallowed error, broken API, data loss |
| Should Fix | Wrong layer for an interface, panic in a library, leaky goroutine |
| Nit | Name preference, comment phrasing, ordering within a block |
These are reviewer anti-patterns — bad habits to avoid when writing the review itself:
| Anti-pattern | Do this instead |
|---|---|
| "I would have written this differently" | drop it, or cite a concrete rule |
Listing every nit you noticed | flag once, note "× N similar" |
No severity labels; comment without file:line | label Must / Should / Nit; anchor with path:line |
| Reviewing the author, not the code | write about the change, not the person |
| Re-doing the work in the review | point to the rule and let them write it |
| Approving without reading tests | tests are part of the diff |
file:line + a rule citation; no bare opinions~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.