go-architect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-architect (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Targets Go 1.26. See STACK.md for pinned dependency versions.
iota and an implemented String() method. Avoid bare primitives. Use 1 << iota for bitmasks.var ErrNotFound = ...) for errors.Is(). Use errors.Join to aggregate multiple errors.type, const, or var at package level, consolidate each kind into a single parenthesized block (type (...), const (...), var (...)) rather than repeating the keyword. Keep unrelated groups separated by a blank line inside the block.Validate() error for structs taking external input; tag-based validation via go-playground/validator.cmp (cmp.Compare[T], cmp.Or, cmp.Less) as the default ordering toolkit.New... to initialize maps, slices, channels safely.Prefer stdlib over hand-rolled or third-party when stdlib now covers it.
slices, maps — collection helpers (Sort, Contains, Index, Clone, Equal, Concat, etc.)cmp — Compare, Less, Or, Ordered — the default ordering toolkit.iter — iter.Seq[T], iter.Seq2[K,V] for sequence-shaped returns (see §6).log/slog — structured logging; default for new code. Reach for zap/zerolog only when slog's allocator perf is provably insufficient.errors — errors.Is, errors.As, errors.Join.for x := range seq { ... } where seq is iter.Seq[T].[]T in slices.Values just to look modern. Round-tripping back to slices.Collect is wasted ceremony.sync.RWMutex directly above the fields it protects. sync/atomic for simple counters.sync.WaitGroup.Go(fn) (Go 1.25+) — replaces Add(1) / go func() { defer Done(); ... }() boilerplate.context.Context as the first parameter for any blocking or I/O. Use signal.NotifyContext for shutdown; the cancellation cause now records which signal fired (Go 1.26).GOMAXPROCS respects cgroup CPU limits since Go 1.25 — don't hardcode in containerized deploys.errors.As for custom types; errors.Is for sentinels.errors.Join(errs...) when collecting multiple errors (validation, parallel fan-out).fmt.Errorf("op: %w", err) to add context while preserving the chain.MustCompile style). Never as control flow.package mypkg_test).t.Helper() as the first line in any custom assertion.testing/synctest (GA in Go 1.25) — virtualizes time, waits for goroutines to quiesce, makes async tests deterministic.stretchr/testify for assertions/mocks/suites when stdlib alone is awkward.util, common, helpers.init() setups. For larger graphs use uber-go/fx or google/wire.spf13/viper for layered env + file + flag configuration.log/slog (stdlib). Structured, context-aware. zap/zerolog only when slog is provably the bottleneck — start with slog.//go:embedStrong preference: raw SQL in `.sql` files, embedded at compile time, executed via jmoiron/sqlx. Avoids ORM magic, keeps queries auditable in git, gives editors full SQL syntax highlighting and linting.
//go:embed queries/get_user_by_id.sql
var getUserByIDSQL string
func (r *UserRepo) GetByID(ctx context.Context, id int64) (User, error) {
var u User
err := r.db.GetContext(ctx, &u, getUserByIDSQL, id)
return u, err
}Layout:
internal/userrepo/
├── repo.go
└── queries/
├── get_user_by_id.sql
├── insert_user.sql
└── list_users.sqlgolang-migrate — versioned up/down pairs in migrations/..sql files and join them in Go. Avoid building SQL by string concatenation against user input — use parameter binding.type Adder[A Adder[A]] interface { Add(A) A } is valid — useful for fluent-style domain types.type IntMap[V any] = map[int]V.golangci-lint v2 — a single binary that aggregates staticcheck, govet, gofmt, goimports, revive, and dozens more. Pin via .golangci.yml (v2 config schema). Run on every commit and in CI. Treat warnings as errors. Drop-in template: assets/golangci.yml — copy to your project root as .golangci.yml and set goimports.local-prefixes to your module path.go fix periodically (revamped in Go 1.26 as push-button modernizers). It rewrites legacy patterns toward current stdlib APIs and respects //go:fix inline directives for local refactors. Ongoing hygiene, not a one-off.gofmt (built-in) plus goimports (via golangci-lint) — no other formatter, no debate.go build, go test, go vet, go work for multi-module repos. Stdlib only — avoid Make/Task wrappers unless multi-language CI demands it.@param). Document specific error conditions.See STACK.md for the full pinned list — viper, validator, cobra/pflag, gin, sqlx, grpc, protobuf-go, testify, fx, golang-migrate, buf.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.