go-concurrency — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-concurrency (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Normative: When you spawn goroutines, make it clear when or whether they exit.
Goroutines can leak by blocking on channel sends/receives. The GC will not terminate a blocked goroutine even if no other goroutine holds a reference to the channel. Even non-leaking in-flight goroutines cause panics (send on closed channel), data races, memory issues, and resource leaks.
cancellation signal, or both
Close, Stop,Shutdown) instead
into synchronous functions
// Good: Clear lifetime with WaitGroup
var wg sync.WaitGroup
for item := range queue {
wg.Add(1)
go func() { defer wg.Done(); process(ctx, item) }()
}
wg.Wait()// Bad: No way to stop or wait
go func() { for { flush(); time.Sleep(delay) } }()Test for leaks with go.uber.org/goleak.
Principle: Never start a goroutine without knowing how it will stop.
Read references/GOROUTINE-PATTERNS.md when implementing stop/done channel patterns, goroutine waiting strategies, or lifecycle-managed workers.
"Do not communicate by sharing memory; instead, share memory by communicating."
This is Go's foundational concurrency design principle. Use channels for ownership transfer and orchestration — when one goroutine produces a value and another consumes it. Use mutexes when multiple goroutines access shared state and channels would add unnecessary complexity.
Default to channels. Fall back to sync.Mutex / sync.RWMutex when the problem is naturally about protecting a shared data structure (e.g., a cache or counter) rather than passing data between goroutines.
Normative: Prefer synchronous functions over asynchronous ones.
| Benefit | Why |
|---|---|
| Localized goroutines | Lifetimes easier to reason about |
| Avoids leaks and races | Easier to prevent resource leaks and data races |
| Easier to test | Check input/output without polling |
| Caller flexibility | Caller adds concurrency when needed |
Advisory: It is quite difficult (sometimes impossible) to remove unnecessary concurrency at the caller side. Let the caller add concurrency when needed.
Read references/GOROUTINE-PATTERNS.md when writing synchronous-first APIs that callers may wrap in goroutines.
The zero-value of sync.Mutex and sync.RWMutex is valid — almost never need a pointer to a mutex.
// Good: Zero-value is valid // Bad: Unnecessary pointer
var mu sync.Mutex mu := new(sync.Mutex)Don't embed mutexes — use a named mu field to keep Lock/Unlock as implementation details, not exported API.
Read references/SYNC-PRIMITIVES.md when implementing mutex-protected structs or deciding how to structure mutex fields.
Normative: Specify channel direction where possible.
Direction prevents errors (compiler catches closing a receive-only channel), conveys ownership, and is self-documenting.
func produce(out chan<- int) { /* send-only */ }
func consume(in <-chan int) { /* receive-only */ }
func transform(in <-chan int, out chan<- int) { /* both */ }Channels should have size zero (unbuffered) or one. Any other size requires justification.
c := make(chan int) // unbuffered — Good
c := make(chan int, 1) // size one — Good
c := make(chan int, 64) // arbitrary — needs justificationRead references/SYNC-PRIMITIVES.md when reviewing detailed channel direction examples with error-prone patterns.
Use atomic.Bool, atomic.Int64, etc. (stdlib sync/atomic since Go 1.19, or go.uber.org/atomic) for type-safe atomic operations.
// Good: Type-safe // Bad: Easy to forget
var running atomic.Bool var running int32 // atomic
running.Store(true) atomic.StoreInt32(&running, 1)
running.Load() running == 1 // race!Advisory: Document thread-safety when it's not obvious from the operation type.
Go users assume read-only operations are safe for concurrent use, and mutating operations are not. Document concurrency when:
Lookup that mutates LRU stateUse a buffered channel as a free list to reuse allocated buffers.
Read references/BUFFER-POOLING.md when implementing a worker pool with reusable buffers or choosing between channel-based pools and sync.Pool.Read references/ADVANCED-PATTERNS.md when implementing request-response multiplexing with channels of channels, or CPU-bound parallel computation across cores.
stop](https://dave.cheney.net/2016/12/22/never-start-a-goroutine-without-knowing-how-it-will-stop) — Dave Cheney
Patterns](https://www.youtube.com/watch?v=5zXAHh5tJqQ) — Bryan Mills (GopherCon 2018)
detector for testing
atomic operations
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.