programming-go — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited programming-go (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Write explicit Go with small packages, inspectable errors, and bounded concurrency. As of 2026-10: Go 1.27 is the current stable release (1.27.2 at research time; 1.26 is the other supported line). Read go.mod, go.work, toolchain directives, build tags, and CI before introducing newer APIs. Use a supported toolchain, but preserve the module's language compatibility unless an upgrade is requested. Recheck official releases when updating this guidance.
Keep control flow and ownership visible. Ordinary functions, structs, and explicit dependency wiring solve most problems. Add an interface, generic abstraction, goroutine, or dependency when it removes a concrete coupling or limitation; don't create infrastructure for hypothetical reuse.
| Version | Useful change and boundary |
|---|---|
| 1.22 | Loop variables declared by the loop have per-iteration semantics; preexisting variables assigned by the loop still share storage. ServeMux supports method and wildcard patterns. |
| 1.23 | Range-over-function iterators and iter, slices, and maps helpers can replace custom collection plumbing. |
| 1.25 | sync.WaitGroup.Go couples task startup with completion accounting; the function must not panic. testing/synctest supports deterministic concurrent tests. |
| 1.26 | new(expr) allocates an initialized value (handy for optional pointer fields). errors.AsType[T] is a typed errors.As. go fix became a modernizer suite with //go:fix inline API migration. Green Tea GC is the default. |
| 1.27 | Methods may declare type parameters. Interface methods still cannot, and generic methods cannot implement interface methods. Struct-literal keys may be nested field selectors. encoding/json/v2, encoding/json/jsontext, and crypto/mldsa are stable. go test runs the stdversion vet check by default. Darwin requires macOS 13+. |
In Go 1.27, encoding/json is reimplemented on top of v2: the v1 API and semantics are kept, but error text may differ (GOEXPERIMENT=nojsonv2 is a temporary opt-out). Calling encoding/json/v2 directly rejects duplicate object names and invalid UTF-8 by default and changes other wire behavior; test existing payloads before migrating. simd and simd/archsimd remain behind GOEXPERIMENT=simd; don't treat them as stable APIs.
When the task is modernization, run go fix ./... on a clean tree and review its diff separately from feature changes. Modernizers are intended to preserve behavior; still run tests afterward.
internal/ limits imports to the subtree rooted at its parent directory; it does not mean strictly “same module.” Preserve the existing layout when it serves the task.sync.Pool is not sync.Pool[T]; verify signatures instead of inventing typed variants.nil on success for error results.%w when callers should inspect the cause. Check with errors.Is or errors.As, not error-string matching.defer calls until a long function exits.WaitGroup waits; it does not cancel work. Bound parallel work and queues.context.Context explicitly as the first parameter for operations with cancellation/deadlines. Don't store request contexts in long-lived structs; call returned cancellation functions to release resources.errgroup when coordinated work needs error propagation and cancellation. Its context only helps if blocking operations observe cancellation.Preserve parse errors and reject values outside the domain:
func parseWorkers(raw string) (int, error) {
n, err := strconv.Atoi(raw)
if err != nil {
return 0, fmt.Errorf("parse worker count: %w", err)
}
if n < 1 {
return 0, fmt.Errorf("worker count must be positive")
}
return n, nil
}This function uses the standard fmt and strconv packages.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.