go-declarations — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-declarations (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pick the simplest declaration form that expresses your intent: scope variables tightly, group related declarations, and let the zero value do its job.
len, cap, error, new, make, copy, any, nil, ...).| Context | Use | Example |
|---|---|---|
| Package-level | var (always) | var startTime = time.Now() |
| Local with computed value | := | s := "foo" |
| Local zero-value, intentional | var | var filtered []int |
| Declared type differs from RHS | var T = expr | var e error = f() |
Read references/scope-and-shadowing.md when fighting subtle bugs caused by := redeclaring an outer variable.// Bad
const a = 1
const b = 2
// Good
const (
a = 1
b = 2
)Inside functions, group adjacent vars even if loosely related:
var (
caller = c.name
format = "json"
timeout = 5 * time.Second
)Zero is the default; reserve it for "uninitialized" by starting enums at iota + 1:
type Operation int
const (
Add Operation = iota + 1 // 1
Subtract // 2
Multiply // 3
)Use plain iota only when the zero value is the sensible default (e.g., LogToStdout = iota).
Read references/iota-and-literals.md for bitmask enums, String() methods, raw strings, and composite-literal formatting.go vet.u := User{}).u := User{Name: "Ada", Email: "[email protected]"}
sptr := &Config{Timeout: 5 * time.Second}
var empty Buffer // zero value, ready to useTest tables with ≤3 fields may use positional literals when the meaning is obvious.
| Scenario | Use | Example |
|---|---|---|
| Empty, will be populated | make(map[K]V) | m := make(map[string]int) |
| Nil, lazily allocated | var | var m map[string]int |
| Known entries up front | Literal | m := map[string]int{"a": 1} |
make signals "initialized but empty" — different from a nil map (which panics on write). Provide a size hint when the count is known: make(map[K]V, n).
Use backticks to avoid escape gymnastics:
// Bad
re := "^\\s*name:\\s*\"(.*)\""
// Good
re := `^\s*name:\s*"(.*)"`Ideal for regex, SQL, JSON, and multi-line text.
any, not interface{}// Old
func Print(v interface{}) { ... }
// New
func Print(v any) { ... }any is an alias for interface{} since Go 1.18 — same type, less noise.
The predeclared identifiers (error, string, len, cap, append, copy, new, make, close, delete, panic, recover, any, true, false, nil, iota) are not reserved words — Go lets you shadow them. Don't.
// Bad — shadows the builtin error type
var error string
// Good
var errorMessage stringgo vet catches the most common cases.
Read references/structs-and-tags.md when designing struct fields that cross a serialization boundary (JSON, YAML, protobuf), embedding types, or formatting many-field literals.
| Anti-pattern | Why it hurts | Do this instead |
|---|---|---|
u := User{} for a zero value | Misleads readers into expecting non-defaults | var u User |
new(T) then assign fields | Two-step where one works | &T{Field: v} |
| Positional struct literals (>3 fields) | Silent breakage on field reordering | Use field names |
iota starting at 0 for an enum | Zero value collides with a real case | iota + 1 |
var m map[string]int then m[k] = v | Panic on nil map write | m := make(map[string]int) |
| Hand-escaped JSON or regex strings | Hard to read, easy to mistype | Raw string literal |
interface{} in new code | Verbose, outdated | any |
var/const; locals use := unless zero-value is intendedconst/var/type are in grouped blocksiota + 1 (or the zero value is explicitly meaningful)makeerror, len, cap, ...)any used instead of interface{}:= redeclaration rules, shadowing traps~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.