docs: improve prose and sweep the skills (#102)

* docs: cap prose paragraphs at 3 sentences and clarify token budgets

CLAUDE.md constrained prose only at whole-file granularity, with three
conflicting per-SKILL.md token numbers and a "why" pattern that
tempted a second sentence per rule. Add a per-paragraph sentence cap,
a budget table clarifying which number measures what, and a mechanical
checker (scripts/check_prose_density.py) wired into the "After
updating a skill" checklist so verbose paragraphs get caught instead
of only whole-file token/line counts.

* docs: rewrite prose paragraphs over the new 3-sentence density cap

CLAUDE.md now caps standalone prose paragraphs at 3 sentences
(scripts/check_prose_density.py). Running it across every skill found
62 flagged paragraphs in 31 skills, dominated by a recurring
"library disclaimer" paragraph repeated near-verbatim across 17
library-specific skills. Restructure each flagged paragraph into
bullets, a table, or a tightened sentence per CLAUDE.md's Formats
guidance, preserving every fact, URL, and cross-reference. Re-scanning
the full repo now reports 0 flagged paragraphs across all skills.

Bump each touched skill's metadata.version by one patch version.
Update README token counts for the 31 touched skills to match.

* docs: drop the prose-density checker script

The script added mechanical enforcement but no CI wiring, so it never
ran anywhere but ad hoc. Keep the 3-sentence prose cap and the
clarified token-budget table in CLAUDE.md; drop the script and its
two call-outs, renumbering the "After updating a skill" checklist
back to a contiguous sequence.
This commit is contained in:
Samuel Berthe
2026-09-02 20:33:18 +02:00
committed by GitHub
parent 8f8e2feb66
commit bac46b0bed
50 changed files with 281 additions and 129 deletions
+2 -1
View File
@@ -1,3 +1,4 @@
/*-workspace/
.worktrees/
.claude/worktrees/
.claude/worktrees/
__pycache__/
+47 -27
View File
@@ -103,7 +103,11 @@ metadata:
bins: [protoc]
```
**Version discipline:** Versions follow semver (`a.b.c`). New skills start at `1.0.0`. When modifying a skill, the developer must increment its `metadata.version` and the plugin version in `.claude-plugin/plugin.json` before merging. CI enforces both checks on PRs. Do not auto-increment versions — remind the developer as a next step.
**Version discipline:**
- Versions follow semver (`a.b.c`); new skills start at `1.0.0`
- When modifying a skill, the developer must increment its `metadata.version` and the plugin version in `.claude-plugin/plugin.json` before merging — CI enforces both checks on PRs
- Do not auto-increment versions — remind the developer as a next step
### Description quality
@@ -130,7 +134,7 @@ description: Implements X in Golang using library/foo
description: Implements X in Golang using library/foo — feature A, feature B, and feature C. Apply when using or adopting library/foo, or when the codebase imports `github.com/library/foo`.
```
**Too broad** (over-triggering) — phrases like "whenever writing Go code", "when naming any identifier", "essential for ANY conversation". These match virtually all Go work and flood the context with irrelevant skills. Fix by narrowing to the specific concern the skill uniquely addresses. Rule 4 pushes on the _number of trigger scenarios_ listed inside that concern, never on the width of the concern itself.
**Too broad** (over-triggering) — phrases like "whenever writing Go code", "when naming any identifier", "essential for ANY conversation". These match virtually all Go work and flood the context with irrelevant skills, so narrow to the specific concern the skill uniquely addresses. Rule 4 pushes on the _number of trigger scenarios_ listed inside that concern, never on the width of the concern itself.
```yaml
# Bad — triggers on all Go work
@@ -226,7 +230,7 @@ Expected hits: `allowed-tools:` lines and labeled generated-artifact blocks only
## Skill Body
The body contains step-by-step instructions. Use secondary markdown files in `references/` for depth (referenced via relative links like `[Details](references/details.md)`). Keep file references one level deep from SKILL.md — avoid deeply nested reference chains. A nested chain gets partially read (`head -100`) and silently truncated, so the deepest content never reaches the model and nothing signals the loss.
The body contains step-by-step instructions. Use secondary markdown files in `references/` for depth (referenced via relative links like `[Details](references/details.md)`). Keep file references one level deep from SKILL.md — a nested chain gets partially read (`head -100`) and silently truncated, so the deepest content never reaches the model and nothing signals the loss.
**Important:** When including non-markdown content (configuration files, scripts, templates, linter configs, etc.), create them as separate files in `assets/` rather than embedding them directly in markdown. Reference these files from your markdown using relative links (e.g., `[View config](assets/example.yml)`). This keeps markdown files clean, makes assets reusable, and allows proper syntax highlighting when the files are viewed separately.
@@ -234,7 +238,7 @@ Polanyi's paradox: most operational knowledge is tacit and resists explicit desc
### Body writing style
- **Write imperatively, verb first** — `Run`, `Reject`, `Validate`. (→ See [Format 5: Imperative Prose](#format-5-imperative-prose-recommended-by-skill-creator).)
- **Write imperatively, verb first** — `Run`, `Reject`, `Validate`. (→ See [Format 5: Imperative Prose](#format-5-imperative-prose).)
- **Explain why, not just what** — reasoning-based instructions let the model handle edge cases you did not foresee. (→ See [Teach reasoning, not only rules](#teach-reasoning-not-only-rules), which also rules on caps-lock imperatives.)
- **Use one term per concept** — mixing "field"/"box"/"element" for the same thing costs accuracy.
- **Give one default with an escape hatch**, never a menu of five libraries. State the pick, then the condition that justifies deviating.
@@ -248,16 +252,23 @@ Polanyi's paradox: most operational knowledge is tacit and resists explicit desc
### Token budgets
- **~100 tokens per description** — loaded at startup for all skills
- **≤ 1,000 characters per description** — hard limit; keep descriptions focused and scannable
- **< 5.000 tokens per SKILL.md** (spec recommendation) — keep focused on essentials
- **< 2.500 tokens per SKILL.md** (project recommendation)
- **< 500 lines per SKILL.md** — move detailed reference material to `references/`; aim for under 250, and note the official median is 147 lines
- **Use secondary markdown files for depth** — Claude reads these on demand, so they don't count against context until needed
- **2-4 skills loaded simultaneously** in a typical session
- **Stay below ~10k tokens of total loaded SKILL.md** to avoid degrading response quality
- **Only the first ~5,000 tokens of a skill survive auto-compaction**, out of a ~25,000-token budget shared by all loaded skills — put load-bearing rules before examples and edge cases
- **Discovery degrades past ~20-50 installed skills** — every description loads at startup, so a crowded listing dilutes triggering for all of them, not just the newest; prune unused skills rather than only shrinking each one
Budgets measure three different units — **one paragraph**, **one file**, and **everything loaded at once**. None supersedes another: a SKILL.md inside its per-file budget still blows the total when three other skills load beside it.
| Budget | Unit | Governs |
| --- | --- | --- |
| ~100 tokens | per description | Startup cost, paid for every installed skill |
| ≤ 1,000 characters | per description | Hard limit — keep descriptions focused and scannable |
| ≤ 3 sentences | per prose paragraph | Standalone prose only; tables, bullets and checklists are exempt |
| < 5,000 tokens | per SKILL.md | The Agent Skills spec's own recommended ceiling |
| < 2,500 tokens | per SKILL.md | This project's tighter recommendation — the number to actually hit |
| < 500 lines | per SKILL.md | Past it, move detail to `references/`; aim under 250 (official median: 147) |
| ~10,000 tokens | total loaded | Steady-state sum of the 2-4 SKILL.md files in context; past it, response quality degrades |
| ~25,000 tokens | total loaded | Shared by all loaded skills at auto-compaction, and only each skill's first ~5,000 tokens survive — put load-bearing rules before examples and edge cases |
| ~20-50 skills | total installed | Discovery degrades past it: every description loads at startup, diluting triggering for all skills, not just the newest |
- **Cap standalone prose at 3 sentences, and carry the "why" as a clause inside the rule's own sentence** rather than a second sentence explaining the first (→ See [Teach reasoning, not only rules](#teach-reasoning-not-only-rules)). Long paragraphs quietly reintroduce the verbosity the per-file budgets exist to prevent, and nothing flags them — line and token counts only trip once the whole file is already bloated. Enumerable content belongs in a table, bullet list or checklist, never in longer prose (→ See [Formats](#formats)).
- **Use secondary markdown files for depth** — Claude reads these on demand, so they don't count against context until needed.
- **Prune installed skills rather than only shrinking each one** — the startup listing is a shared budget too.
This is a budget. A 100 lines SKILL.md is even better. Feel free to stay far below the limits.
@@ -444,7 +455,11 @@ The first three form a "deep analysis" cluster for temporary focused investigati
### Atomic skills and deduplication
Concept drift between skills creates confusion when the agent loads the wrong one — or two competing ones. Each concept MUST live in exactly one skill (the "owner"). All other skills cross-reference the owner with `→ See` using the fully-qualified `owner/repo@skill` identifier. When splitting or merging skills, update every cross-reference to the affected skills. Prefer small, focused skills over large monolithic ones.
Concept drift between skills creates confusion when the agent loads the wrong one — or two competing ones. Prefer small, focused skills over large monolithic ones.
- Each concept MUST live in exactly one skill (the "owner")
- All other skills cross-reference the owner with `→ See` using the fully-qualified `owner/repo@skill` identifier
- When splitting or merging skills, update every cross-reference to the affected skills
### Company override convention
@@ -498,7 +513,7 @@ Skills should NOT re-explain rules that are already enforced by linters (e.g. go
### Teach reasoning, not only rules
Skills MUST teach Claude how to think about problems, not just list prescriptive rules. Every recommendation needs a "why" — what goes wrong without it, what consequence the reader avoids.
Skills MUST teach Claude how to think about problems, not just list prescriptive rules. Every recommendation needs a "why" — what goes wrong without it, what consequence the reader avoids — riding in the same sentence as the rule via an em dash or "because", never as a separate follow-up sentence. A "why" promoted to its own sentence doubles every rule and pushes the paragraph past the 3-sentence prose cap (→ See [Token budgets](#token-budgets)).
Treat ALWAYS/NEVER in caps as a smell. Reserve them for genuinely order-dependent or destructive steps, where a wrong sequence loses data or breaks the build. Reframe every other bare imperative as reasoning, so the model can apply it to cases the rule never anticipated.
@@ -514,7 +529,7 @@ Diagnostic tools include CLI commands (pprof, fieldalignment, benchstat), runtim
Transformation patterns:
- **Best Practices items**: embed the tradeoff in one sentence — "Naked returns help in short functions but become confusing when readers must scroll to find what's returned"
- **Best Practices items**: embed the tradeoff in the rule's own sentence — "Naked returns help in short functions — they confuse once readers must scroll to find what's returned"
- **Common Mistakes tables**: inject the "because" into the Fix column — "`math/rand` output is predictable; an attacker can reproduce the sequence. Use `crypto/rand`"
- **Code example comments**: carry the reasoning — `// ✗ Bad — nil map has no backing storage; writing panics at runtime`
- **Section intros**: add a 1-2 sentence framing paragraph that establishes the mental model before listing specifics
@@ -702,7 +717,12 @@ See `EVALUATIONS.md` for the canonical format.
After updating `EVALUATIONS.md` sum all the skill reports and update the table in `Skill evaluations` section of README.md.
Also update the **Summary table** at the top of `EVALUATIONS.md`: add a new row for the skill (or update the existing row if re-running), then recompute the **Total** row by summing all numerators and denominators across all skills. The table is ordered by Delta ascending (low → high). Populate the Concern column using these rules: "Low delta" (≤32pp), "High without" (Without ≥65%), "Low with-skill score" (With ≤90%) — combine when multiple apply. Use bold on Concern values to draw attention. The **Uplift** column shows `With / Without` rounded to 2 decimal places and suffixed with `×` (e.g. `1.64×`); recompute it for every row including the Total.
Also update the **Summary table** at the top of `EVALUATIONS.md`, which is ordered by Delta ascending (low → high):
- Add a new row for the skill, or update the existing row when re-running
- Recompute the **Total** row by summing all numerators and denominators across all skills
- Populate the Concern column — "Low delta" (≤32pp), "High without" (Without ≥65%), "Low with-skill score" (With ≤90%) — combining labels when several apply, in bold to draw attention
- Recompute the **Uplift** column for every row including the Total: `With / Without`, rounded to 2 decimal places and suffixed with `×` (e.g. `1.64×`)
## Workflows
@@ -820,15 +840,7 @@ Testing:
## Formats
Write short sentences.
### Format 5: Imperative Prose (recommended by skill-creator)
```md
## Writing Rules
Cut ruthlessly — every word must work. Remove filler words like "very", "really", "incredibly". Use active voice. Vary sentence length: 3-5 words for impact, then medium length for explanation.
```
Write short sentences. Prose is for standalone rules only — anything enumerable belongs in a table, bullet list or checklist, per **Prefer tables and checklists over prose** in [Body writing style](#body-writing-style).
### Format 1: Categorized examples (Good / Bad)
@@ -880,3 +892,11 @@ ALWAYS use this exact template:
3. A scope MAY be provided after a type, in parentheses
4. A description MUST immediately follow the colon and space
```
### Format 5: Imperative Prose
```md
## Writing Rules
Cut ruthlessly — every word must work. Remove filler words like "very", "really", "incredibly". Use active voice. Vary sentence length: 3-5 words for impact, then medium length for explanation.
```
+12 -12
View File
@@ -194,31 +194,31 @@ These skills are designed as **atomic, cross-referencing units**. A skill may re
| ⭐️ | ✅ `golang-data-structures` | ⚡ | -39% | 93 | 2,608 | 6,327 |
| ⭐️ | ✅ `golang-database` | ⚡ ⚙️ | -38% | 97 | 2,721 | 7,243 |
| ⭐️ | ✅ `golang-design-patterns` | ⚡ ⚙️ | -37% | 80 | 2,694 | 9,400 |
| ⭐️ | ✅ `golang-documentation` | ⚡ 🤖 ⚙️ | -53% | 75 | 3,168 | 11,259 |
| ⭐️ | ✅ `golang-documentation` | ⚡ 🤖 ⚙️ | -53% | 75 | 3,163 | 11,876 |
| ⭐️ | ✅ `golang-error-handling` | ⚡ 🤖 ⚙️ | -26% | 141 | 1,734 | 4,693 |
| ⭐️ | ✅ `golang-how-to` | ⚡ | — | 183 | 4,196 | 15,197 |
| ⭐️ | ✅ `golang-how-to` | ⚡ | — | 184 | 4,210 | 17,583 |
| ⭐️ | ✅ `golang-modernize` | ⚡ 🤖 | -43% | 104 | 3,486 | 15,145 |
| ⭐️ | ✅ `golang-naming` | ⚡ ⚙️ | -23% | 159 | 3,031 | 7,399 |
| ⭐️ | ✅ `golang-refactoring` | ⚡ 🧠 🤖 ⚙️ | — | 245 | 3,835 | 20,392 |
| ⭐️ | ✅ `golang-safety` | ⚡ | -58% | 78 | 2,614 | 5,384 |
| ⭐️ | ✅ `golang-testing` | ⚡ 🧠 🤖 ⚙️ | -32% | 115 | 4,464 | 7,571 |
| ⭐️ | ✅ `golang-troubleshooting` | ⚡ 🧠 🤖 | -32% | 127 | 2,929 | 16,665 |
| ⭐️ | ✅ `golang-testing` | ⚡ 🧠 🤖 ⚙️ | -32% | 115 | 4,270 | 8,822 |
| ⭐️ | ✅ `golang-troubleshooting` | ⚡ 🧠 🤖 | -32% | 173 | 2,993 | 18,035 |
| ⭐️ | ✅ `golang-security` | ⚡ 🧠 🤖 | -32% | 85 | 3,187 | 21,623 |
| | ✅ `golang-benchmark` | ⚡ 🧠 | -50% | 102 | 3,150 | 30,332 |
| | ✅ `golang-benchmark` | ⚡ 🧠 | -50% | 102 | 3,153 | 33,396 |
| | ✅ `golang-cli` | ⚡ | -43% | 125 | 2,338 | 6,153 |
| | ✅ `golang-concurrency` | ⚡ 🤖 ⚙️ | -39% | 72 | 2,196 | 6,826 |
| | ✅ `golang-context` | ⚡ ⚙️ | -34% | 82 | 1,211 | 4,021 |
| | ✅ `golang-continuous-integration` | ⚡ | -59% | 82 | 3,444 | 12,706 |
| | ✅ `golang-continuous-integration` | ⚡ | -59% | 177 | 3,542 | 12,804 |
| | ✅ `golang-dependency-injection` | ⚡ 🤖 ⚙️ | -47% | 178 | 3,016 | 5,287 |
| | ✅ `golang-dependency-management` | ⚡ | -54% | 77 | 2,407 | 5,545 |
| | ✅ `golang-structs-interfaces` | ⚡ ⚙️ | -35% | 111 | 3,076 | 3,076 |
| | ✅ `golang-lint` | ⚡ 🤖 | -41% | 98 | 1,877 | 6,295 |
| | ✅ `golang-observability` | ⚡ 🤖 ⚙️ | -37% | 163 | 3,118 | 18,722 |
| | ✅ `golang-performance` | ⚡ 🧠 🤖 | -39% | 129 | 2,226 | 18,390 |
| | ✅ `golang-gopls` | ⚡ | — | 219 | 2,317 | 12,299 |
| | ✅ `golang-pkg-go-dev` | ⚡ | — | 230 | 3,423 | 5,237 |
| | ✅ `golang-popular-libraries` | ⚡ | -30% | 51 | 1,074 | 4,702 |
| | ✅ `golang-project-layout` | ⚡ | -38% | 69 | 1,692 | 5,907 |
| | ✅ `golang-observability` | ⚡ 🤖 ⚙️ | -37% | 164 | 3,128 | 19,583 |
| | ✅ `golang-performance` | ⚡ 🧠 🤖 | -39% | 130 | 2,226 | 19,820 |
| | ✅ `golang-gopls` | ⚡ | — | 219 | 2,317 | 12,312 |
| | ✅ `golang-pkg-go-dev` | ⚡ | — | 170 | 3,442 | 5,386 |
| | ✅ `golang-popular-libraries` | ⚡ | -30% | 156 | 1,181 | 5,093 |
| | ✅ `golang-project-layout` | ⚡ | -38% | 105 | 1,761 | 6,257 |
| | ✅ `golang-stay-updated` | ⚡ | -56% | 44 | 1,802 | 1,802 |
**Tools:**
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.1"
version: "1.3.2"
openclaw:
emoji: "📊"
homepage: https://github.com/samber/cc-skills-golang
@@ -41,7 +41,11 @@ This skill covers the full measurement workflow: write a benchmark, run it, prof
### File and Ordering Conventions
Benchmark functions live in a `_bench_test.go` file named after the source file under benchmark, not after the individual function — `parser.go` -> `parser_bench_test.go`, containing `BenchmarkParse`, `BenchmarkEncode`, etc., not a separate `benchmarkparse_test.go` per function. Keeping benchmarks in their own file (instead of mixed into `parser_test.go`) keeps `go test -bench=. ./pkg/parser` output free of unrelated `Test*` noise, and separates fixtures sized for measurement (large inputs, long-lived setup) from those sized for correctness — the two rarely share the same shape. The file still follows Go's one-test-file-per-source-file convention (→ See `samber/cc-skills-golang@golang-testing` skill), just with the `_bench` suffix marking its narrower purpose.
Benchmark functions live in a `_bench_test.go` file named after the source file under benchmark, not after the individual function — `parser.go` -> `parser_bench_test.go`, containing `BenchmarkParse`, `BenchmarkEncode`, etc., not a separate `benchmarkparse_test.go` per function.
- Keeping benchmarks in their own file (instead of mixed into `parser_test.go`) keeps `go test -bench=. ./pkg/parser` output free of unrelated `Test*` noise.
- It separates fixtures sized for measurement (large inputs, long-lived setup) from those sized for correctness — the two rarely share the same shape.
- The file still follows Go's one-test-file-per-source-file convention (→ See `samber/cc-skills-golang@golang-testing` skill), just with the `_bench` suffix marking its narrower purpose.
Order `Benchmark*` functions inside `parser_bench_test.go` to mirror the order of the functions/methods they measure in `parser.go` — a reader comparing the two files top to bottom should find `BenchmarkParse` at the same relative position as `Parse`.
@@ -91,7 +91,11 @@ cob -bench-args "test -run '^$' -bench . -benchmem -benchtime=3s ./..."
# Skip cob for a specific commit: include [skip cob] in commit message
```
**Caution:** `cob` uses `git reset` internally, which can cause data loss if uncommitted changes exist. Always commit your work before running. Additionally, `cob` requires all benchmarks to pass; it skips CI gating if any benchmark fails. For safety, run only in CI pipelines, not locally. Note that `cob` compares single runs without `benchstat`-style statistics, making it more susceptible to noise than `benchdiff`.
**Caution:** `cob` uses `git reset` internally, which can cause data loss if uncommitted changes exist — always commit your work before running.
- For safety, run only in CI pipelines, not locally.
- `cob` requires all benchmarks to pass; it skips CI gating if any benchmark fails.
- `cob` compares single runs without `benchstat`-style statistics, making it more susceptible to noise than `benchdiff`.
Best for: simple post-commit regression gating in CI where statistical rigor is less critical than fast feedback.
+5 -5
View File
@@ -850,23 +850,23 @@ The function itself is the bottleneck. It does expensive work directly (tight lo
### Flat low + cum high
The function calls slow things but does little work itself. It's a coordinator or dispatcher. Drill into callees with `list` or `peek`. The fix is usually in the called functions, or reducing how often they're called.
The function calls slow things but does little work itself — it's a coordinator or dispatcher. Drill into callees with `list` or `peek`. The fix is usually in the called functions, or reducing how often they're called.
### `alloc_objects` high, `inuse_space` low
Short-lived allocations creating GC churn. Objects are allocated and freed rapidly each one is cheap individually but the aggregate volume triggers frequent GC cycles. Common sources: `fmt.Errorf` in hot paths (allocates every call), interface boxing (`any` arguments), string-to-byte conversions, slice growth without preallocation. → See `samber/cc-skills-golang@golang-performance` skill for allocation reduction patterns.
Short-lived allocations creating GC churn — objects are allocated and freed rapidly, each cheap individually but the aggregate volume triggers frequent GC cycles. Common sources: `fmt.Errorf` in hot paths (allocates every call), interface boxing (`any` arguments), string-to-byte conversions, slice growth without preallocation. → See `samber/cc-skills-golang@golang-performance` skill for allocation reduction patterns.
### `inuse_space` growing over time
Memory leak. Take two heap snapshots minutes apart and compare with `-base` (see Comparing Profiles above). Growing types reveal the leak source. Common causes: unbounded caches, maps that never shrink (Go maps don't release bucket memory on delete), goroutine leaks holding references.
Memory leak. Take two heap snapshots minutes apart and compare with `-base` (see Comparing Profiles above) — growing types reveal the leak source. Common causes: unbounded caches, maps that never shrink (Go maps don't release bucket memory on delete), goroutine leaks holding references.
### Mutex/block profile hot
Contention, not CPU. The CPU is waiting, not working. The goroutines are all trying to acquire the same lock or read from the same channel. Reduce critical section scope, shard locks across multiple mutexes, or use lock-free structures (`sync/atomic`, `sync.Map` for read-heavy workloads). → See `samber/cc-skills-golang@golang-concurrency` skill.
Contention, not CPU — the goroutines are all waiting to acquire the same lock or read from the same channel instead of working. Reduce critical section scope, shard locks across multiple mutexes, or use lock-free structures (`sync/atomic`, `sync.Map` for read-heavy workloads). → See `samber/cc-skills-golang@golang-concurrency` skill.
### Many goroutines blocked on same channel/mutex
Serialization bottleneck. All work funnels through a single point. The throughput ceiling is the speed of that single point. Consider worker pools with multiple independent queues, sharding the work, or buffered channels to smooth bursts.
Serialization bottleneck — all work funnels through a single point, so the throughput ceiling is the speed of that single point. Consider worker pools with multiple independent queues, sharding the work, or buffered channels to smooth bursts.
### `runtime.mallocgc` dominates CPU profile
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.4.1"
version: "1.4.2"
openclaw:
emoji: "🚀"
homepage: https://github.com/samber/cc-skills-golang
@@ -118,7 +118,10 @@ Create `.golangci.yml` at the root of the project. See the `samber/cc-skills-gol
`.github/workflows/security.yml` — see [security.yml](./assets/security.yml)
CI MUST run `govulncheck`. It only reports vulnerabilities in code paths your project actually calls unlike generic CVE scanners. CodeQL results appear in the repository's Security tab. Bearer is good at detecting sensitive data flow issues.
CI MUST run `govulncheck` — it only reports vulnerabilities in code paths your project actually calls, unlike generic CVE scanners.
- CodeQL results appear in the repository's Security tab.
- Bearer is good at detecting sensitive data flow issues.
### CodeQL Configuration
+11 -3
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "🗃"
homepage: https://github.com/samber/cc-skills-golang
@@ -23,7 +23,11 @@ paths:
# Go Data Structures
Built-in and standard library data structures: internals, correct usage, and selection guidance. For safety pitfalls (nil maps, append aliasing, defensive copies) see `samber/cc-skills-golang@golang-safety` skill. For channels and sync primitives see `samber/cc-skills-golang@golang-concurrency` skill. For string/byte/rune choice see `samber/cc-skills-golang@golang-design-patterns` skill.
Built-in and standard library data structures: internals, correct usage, and selection guidance.
- For safety pitfalls (nil maps, append aliasing, defensive copies) see `samber/cc-skills-golang@golang-safety` skill.
- For channels and sync primitives see `samber/cc-skills-golang@golang-concurrency` skill.
- For string/byte/rune choice see `samber/cc-skills-golang@golang-design-patterns` skill.
## Best Practices Summary
@@ -158,7 +162,11 @@ For advanced data structures (trees, sets, queues, stacks) beyond the standard l
- **`deckarep/golang-set`** — thread-safe and non-thread-safe set implementations
- **`gammazero/deque`** — fast double-ended queue
When using third-party libraries, refer to their official documentation and code examples for current API signatures. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
When using third-party libraries, refer to their official documentation and code examples for current API signatures.
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## Cross-References
@@ -91,7 +91,7 @@ avg := sum / float64(r.Len())
## strings.Builder vs bytes.Buffer
**strings.Builder:** Optimized for building strings. `String()` returns the accumulated string without copying. Use for concatenating string parts. `Reset()` discards the buffer.
**strings.Builder:** Optimized for building strings by concatenating parts — `String()` returns the accumulated string without copying. `Reset()` discards the buffer.
**bytes.Buffer:** Implements both `io.Reader` and `io.Writer`. Use for I/O operations, encoding/decoding, or when you need both read and write. `Reset()` reuses the allocated memory.
+1 -1
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.1"
version: "1.3.2"
openclaw:
emoji: "🗄"
homepage: https://github.com/samber/cc-skills-golang
@@ -224,6 +224,11 @@ Always present findings as suggestions with data (scan counts, table size), neve
- **Avoid N+1 queries** — use `JOIN` or batch `WHERE id IN (...)` instead of querying in a loop
- **Suggest improvements, never execute them** — performance changes (indexes, query rewrites, configuration) need human review in context of production data and workload patterns
Batch operations SHOULD use 1001,000 rows per batch — adjust based on row size and database load. Cursor-based pagination MUST replace `OFFSET` for large datasets — the cursor column MUST be chosen based on actual indexes (e.g., `created_at`, `user_id`). NEVER create indexes blindly — check existing indexes, measure with `EXPLAIN ANALYZE`, and present findings as suggestions. N+1 queries MUST be eliminated — use `JOIN` or batch `WHERE id IN (...)`.
**Rules:**
- Batch operations SHOULD use 1001,000 rows per batch — adjust based on row size and database load.
- Cursor-based pagination MUST replace `OFFSET` for large datasets — the cursor column MUST be chosen based on actual indexes (e.g., `created_at`, `user_id`).
- NEVER create indexes blindly — check existing indexes, measure with `EXPLAIN ANALYZE`, and present findings as suggestions.
- N+1 queries MUST be eliminated — use `JOIN` or batch `WHERE id IN (...)`.
→ See `samber/cc-skills-golang@golang-observability` skill for database metrics and query monitoring. → See `samber/cc-skills@promql-cli` skill for querying pool metrics (`db_open_connections`, `db_in_use_connections`, `db_idle_connections`) via CLI.
+4 -1
View File
@@ -213,6 +213,9 @@ func (s *UserRepoSuite) SetupSuite() {
| Constraint violations | | ✓ |
| Query performance | | ✓ (with EXPLAIN) |
Unit tests MUST use mocks (interface mocks or sqlmock) — no real database connections. Integration tests MUST use build tags (`//go:build integration`) to separate from unit tests. Integration tests SHOULD use testcontainers-go for reproducible database environments in CI. NEVER test against production databases.
- Unit tests MUST use mocks (interface mocks or sqlmock) — no real database connections.
- Integration tests MUST use build tags (`//go:build integration`) to separate from unit tests.
- Integration tests SHOULD use testcontainers-go for reproducible database environments in CI.
- NEVER test against production databases.
→ See `samber/cc-skills-golang@golang-testing` skill for general test patterns and CI configuration.
+7 -4
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.1"
version: "1.3.2"
openclaw:
emoji: "📝"
homepage: https://github.com/samber/cc-skills-golang
@@ -36,7 +36,10 @@ Write documentation that serves both humans and AI agents. Good documentation ma
## Cross-References
See `samber/cc-skills-golang@golang-naming` skill for naming conventions in doc comments. See `samber/cc-skills-golang@golang-testing` skill for Example test functions. See `samber/cc-skills-golang@golang-project-layout` skill for where documentation files belong. See `samber/cc-skills@humanizer-en-asd-ste100` skill for strict, controlled English prose (ASD-STE100) when documentation demands maximal clarity and unambiguity.
- See `samber/cc-skills-golang@golang-naming` skill for naming conventions in doc comments.
- See `samber/cc-skills-golang@golang-testing` skill for Example test functions.
- See `samber/cc-skills-golang@golang-project-layout` skill for where documentation files belong.
- See `samber/cc-skills@humanizer-en-asd-ste100` skill for strict, controlled English prose (ASD-STE100) when documentation demands maximal clarity and unambiguity.
## Writing Principles
@@ -168,9 +171,9 @@ For the full README guidance and application-specific sections, see [Project Doc
## Step 5: CONTRIBUTING & Changelog
**CONTRIBUTING.md** — Help contributors get started in under 10 minutes. Include: prerequisites, clone, build, test, PR process. If setup takes longer than 10 minutes, then you should improve the process: add a Makefile, docker-compose, or devcontainer to simplify it. See [Project Docs](./references/project-docs.md#contributingmd).
**CONTRIBUTING.md** — Help contributors get started in under 10 minutes, covering prerequisites, clone, build, test, and PR process. If setup takes longer, improve the process with a Makefile, docker-compose, or devcontainer. See [Project Docs](./references/project-docs.md#contributingmd).
**Changelog** — Track changes using [Keep a Changelog](https://keepachangelog.com/) format or GitHub Releases. Copy the template from [templates/CHANGELOG.md](./assets/templates/CHANGELOG.md). Each entry answers _what changed for the reader_ — internal refactors without user-visible impact belong in commit history. Don't inflate a fixed edge case into a broad "reliability improvement" claim. See [Project Docs](./references/project-docs.md#changelog).
**Changelog** — Track changes using [Keep a Changelog](https://keepachangelog.com/) format or GitHub Releases, copying the template from [templates/CHANGELOG.md](./assets/templates/CHANGELOG.md). Write each entry to answer _what changed for the reader_ — internal refactors without user-visible impact belong in commit history, and a fixed edge case never becomes a broad "reliability improvement" claim. See [Project Docs](./references/project-docs.md#changelog).
## Step 6: Library-Specific Documentation
@@ -17,7 +17,7 @@
## README.md
A LICENSE file MUST exist in every project. A README is the front page of your project. Make it simple, clear, and scannable. A copy-paste template with empty sections is available at [templates/README.md](./templates/README.md).
A LICENSE file MUST exist in every project. The README is the project's front page — make it simple, clear, and scannable. A copy-paste template with empty sections is available at [templates/README.md](./templates/README.md).
### Section Order
@@ -58,7 +58,7 @@ If setup takes more than 10 minutes, add these improvements:
## Changelog
CHANGELOG MUST be updated for every release. Track notable changes for each release. Use [Keep a Changelog](https://keepachangelog.com/) format. Copy the template from [templates/CHANGELOG.md](./templates/CHANGELOG.md).
CHANGELOG MUST be updated for every release, tracking the notable changes it contains. Use [Keep a Changelog](https://keepachangelog.com/) format. Copy the template from [templates/CHANGELOG.md](./templates/CHANGELOG.md).
### Format
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.1.1"
version: "1.1.2"
openclaw:
emoji: "🪡"
homepage: https://github.com/samber/cc-skills-golang
@@ -38,7 +38,11 @@ Note: `google/wire` was archived in August 2025 (feature-complete; bug fixes sti
**Official Resources:** [pkg.go.dev](https://pkg.go.dev/github.com/google/wire) · [github.com/google/wire](https://github.com/google/wire) · [User Guide](https://github.com/google/wire/blob/main/docs/guide.md) · [Best Practices](https://github.com/google/wire/blob/main/docs/best-practices.md)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
```bash
go get -tool github.com/google/wire/cmd/wire@latest
+1 -1
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness. Requires the gopls binary (go install golang.org/x/tools/gopls@latest) v0.20+ on PATH.
metadata:
author: samber
version: "1.1.0"
version: "1.1.1"
openclaw:
emoji: "🛰️"
homepage: https://github.com/samber/cc-skills-golang
+5 -5
View File
@@ -16,11 +16,11 @@ Source: [tip.golang.org/gopls/features](https://tip.golang.org/gopls/features/).
**Definition** (`textDocument/definition`, CLI `gopls definition`) — jumps to a symbol's declaration. Handles more than plain identifiers: on an import path it lists the imported package's declarations; on a `go:linkname` directive it finds the linked symbol; on a `go:embed` pattern it finds the embedded file; on a doc-comment link it follows the reference; on a non-Go function it can return the assembly implementation; on `return` it locates the named result variables; on `goto`/`break`/`continue` it finds the target label or block. Already at the declaration → most clients reinterpret the request as "find references" instead.
**Type Definition** (`textDocument/typeDefinition`, no CLI equivalent) — jumps to the _named type_ underlying a symbol, unwrapping pointer, array, slice, channel, and map constructors first. For `x chan []*T`, this reports the definition of `T`. Only works on symbols, not arbitrary expressions. No agent-invocable path: it is absent from the native `LSP` tool's fixed operation list (`goToDefinition`, `findReferences`, `hover`, `documentSymbol`, `workspaceSymbol`, `goToImplementation`, call hierarchy), so only a full editor LSP client can reach it.
**Type Definition** (`textDocument/typeDefinition`, no CLI equivalent) — jumps to the _named type_ underlying a symbol, unwrapping pointer, array, slice, channel, and map constructors first. For `x chan []*T`, this reports the definition of `T`; it works only on symbols, not arbitrary expressions. No agent-invocable path: it is absent from the native `LSP` tool's fixed operation list (`goToDefinition`, `findReferences`, `hover`, `documentSymbol`, `workspaceSymbol`, `goToImplementation`, call hierarchy), so only a full editor LSP client can reach it.
**References** (`textDocument/references`, CLI `gopls references`) — lists every use of a symbol. For an interface method, this includes concrete implementations; for a package declaration, it includes both direct imports and other files' package clauses; for an embedded field, it reports only field references (use Type Definition to find references to the type itself). **Scoping gotcha:** results reflect only the build configuration of the queried file — a query issued against `foo_windows.go` will not surface a match in `bar_linux.go`. Built-in symbols (`int`, `append`) are rejected as too numerous to be useful.
**References** (`textDocument/references`, CLI `gopls references`) — lists every use of a symbol: for an interface method, this includes concrete implementations; for a package declaration, it includes both direct imports and other files' package clauses; for an embedded field, it reports only field references (use Type Definition to find references to the type itself). **Scoping gotcha:** results reflect only the build configuration of the queried file — a query issued against `foo_windows.go` will not surface a match in `bar_linux.go`. Built-in symbols (`int`, `append`) are rejected as too numerous to be useful.
**Implementation** (`textDocument/implementation`, CLI `gopls implementation`) — on an interface, returns concrete implementations and sub-interfaces; on a concrete type, returns interfaces it satisfies; on an interface method, returns the concrete methods satisfying it, and vice versa. Matching uses method sets for types and signatures for functions. Generic types are treated as wildcards: a candidate is included if _any_ instantiation would allow one to implement the other, without full unification checking. LSP's built-in bias toward subtypes makes this query directionally asymmetric — for full bidirectional traversal, use Type Hierarchy instead.
**Implementation** (`textDocument/implementation`, CLI `gopls implementation`) — on an interface, returns concrete implementations and sub-interfaces; on a concrete type, returns interfaces it satisfies; on an interface method, returns the concrete methods satisfying it, and vice versa. Matching uses method sets for types and signatures for functions, with generic types treated as wildcards a candidate is included if _any_ instantiation would allow one to implement the other, without full unification checking. LSP's built-in bias toward subtypes makes this query directionally asymmetric — for full bidirectional traversal, use Type Hierarchy instead.
**Document Symbol** (`textDocument/documentSymbol`, CLI `gopls symbols`) — outline of a single file's top-level declarations. File-scoped; use Symbol for cross-file search.
@@ -28,7 +28,7 @@ Source: [tip.golang.org/gopls/features](https://tip.golang.org/gopls/features/).
**Selection Range** (`textDocument/selectionRange`, no CLI equivalent) — expands or contracts the current selection along syntactic boundaries (expression → statement → block → function). Useful for selecting exactly the region an Extract refactor needs.
**Call Hierarchy** (`textDocument/prepareCallHierarchy` + `callHierarchyItem/incomingCalls`/`outgoingCalls`, CLI `gopls call_hierarchy`) — shows a function's callers and callees as a static graph. **Only static calls are included** — calls made through a function value or an interface method are invisible, since detecting them isn't analytically tractable. Corroborate with References when a dynamically-dispatched call site matters. Invoke on the function declaration's name.
**Call Hierarchy** (`textDocument/prepareCallHierarchy` + `callHierarchyItem/incomingCalls`/`outgoingCalls`, CLI `gopls call_hierarchy`) — shows a function's callers and callees as a static graph. **Only static calls are included** — calls made through a function value or an interface method are invisible, since detecting them isn't analytically tractable. Invoke on the function declaration's name, and corroborate with References when a dynamically-dispatched call site matters.
**Type Hierarchy** (`textDocument/prepareTypeHierarchy` + `typeHierarchyItem/subtypes`/`typeHierarchy/supertypes`, no CLI equivalent yet) — bidirectional view of the subtyping relation: which types implement an interface, and which interfaces a type satisfies. Resolves the asymmetry Implementation has. Limited to **named types** (unlike Implementation, which also matches unnamed function types); alias types are excluded; function-local types are visible only within the same package.
@@ -125,7 +125,7 @@ All of these send edits/navigation back to the editor via `showDocument`, which
## Non-Go files
**Templates** (`text/template`/`html/template`) — disabled until `templateExtensions` lists at least one extension (templates have no canonical extension of their own); the editor also needs to associate that extension with the `tmpl`/`gotmpl` language ID (e.g. VS Code's `files.associations`). Inside `{{ }}` delimiters: diagnostics (parse errors; missing functions are not flagged), full syntax highlighting, definitions and references (all templates share one global scope), and completions. Hover, semantic tokens, symbol search, and document highlight are not yet implemented. Custom delimiters other than `{{`/`}}` are not understood.
**Templates** (`text/template`/`html/template`) — disabled until `templateExtensions` lists at least one extension (templates have no canonical extension of their own); the editor also needs to associate that extension with the `tmpl`/`gotmpl` language ID (e.g. VS Code's `files.associations`). Inside `{{ }}` delimiters: diagnostics (parse errors; missing functions are not flagged), full syntax highlighting, definitions and references (all templates share one global scope), and completions. Hover, semantic tokens, symbol search, and document highlight are not yet implemented, and custom delimiters other than `{{`/`}}` are not understood.
**go.mod / go.work** — hover, hints, vulncheck-driven diagnostics, and code lenses (add dependency, upgrade dependency, tidy, run `govulncheck`) are supported; the upstream page marks the fine-grained behavior of each as still under documentation, so verify current behavior directly against a `go.mod` file in an editor session rather than relying on an exhaustive list here.
+1 -1
View File
@@ -1,6 +1,6 @@
# gopls settings reference
Source: [tip.golang.org/gopls/settings](https://tip.golang.org/gopls/settings). Settings are passed via the LSP client's `initializationOptions` (editor-specific config file/UI) — there is no `gopls.json` read from the workspace by default. Full canonical list: `gopls api-json`. Record the chosen settings in the project's agent-config file (CLAUDE.md, AGENTS.md, or equivalent), so future sessions pick them up without rediscovering them.
Source: [tip.golang.org/gopls/settings](https://tip.golang.org/gopls/settings); full canonical list: `gopls api-json`. Settings are passed via the LSP client's `initializationOptions` (editor-specific config file/UI) — there is no `gopls.json` read from the workspace by default. Record the chosen settings in the project's agent-config file (CLAUDE.md, AGENTS.md, or equivalent), so future sessions pick them up without rediscovering them.
## Table of contents
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "0.2.1"
version: "0.2.2"
openclaw:
emoji: "🔮"
homepage: https://github.com/samber/cc-skills-golang
@@ -33,7 +33,11 @@ paths:
Both major libraries are schema-first: write SDL (`.graphql` files), bind Go resolvers. Choose based on project size and team preferences.
This skill is not exhaustive. Refer to each library's official documentation and code examples for current API signatures. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive — refer to each library's official documentation and code examples for current API signatures:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## Library Choice
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "🌐"
homepage: https://github.com/samber/cc-skills-golang
@@ -40,7 +40,11 @@ paths:
Treat gRPC as a pure transport layer — keep it separate from business logic. The official Go implementation is `google.golang.org/grpc`.
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## Quick Reference
+1 -1
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness. Requires git.
metadata:
author: samber
version: "1.4.1"
version: "1.4.2"
openclaw:
emoji: "🧭"
homepage: https://github.com/samber/cc-skills-golang
@@ -257,7 +257,13 @@ These four skills all touch "third-party packages", but each owns a different st
> Note: this skill cross-references the other three in its body (and they reference it back). Prefer `golang-pkg-go-dev` over Context7 for any Go package fact-lookup.
**Sub-boundary — `godig` vs `gopls`:** both touch third-party code, but `godig` queries the remote pkg.go.dev index (works for packages not yet added to the project, no local build needed) while `gopls` (→ `samber/cc-skills-golang@golang-gopls`, via its MCP server, the native `LSP` tool, or its CLI) reasons about your actual resolved build in `go.sum` (including `replace`d forks). "Where is `Foo` defined in my repo?" or "find every call site of this dependency's function in my code" → `golang-gopls` (`go_search`/`go_symbol_references`), not `golang-pkg-go-dev` — godig has no visibility into local, unpublished code or call sites inside your own repo. "Does this package I haven't added yet have known CVEs?" → `golang-pkg-go-dev` (`vulns`); "can my current build actually reach a vulnerability in a dependency I already use?" → `golang-gopls` (`go_vulncheck`) or `golang-security` (`govulncheck` whole-tree). See the `samber/cc-skills-golang@golang-gopls` skill for the full gopls reference, and the `samber/cc-skills-golang@golang-how-to` skill's "`godig` vs gopls vs Context7 vs govulncheck" section for the full breakdown.
**Sub-boundary — `godig` vs `gopls`:** both touch third-party code, but `godig` queries the remote pkg.go.dev index (works for packages not yet added to the project, no local build needed) while `gopls` (→ `samber/cc-skills-golang@golang-gopls`, via its MCP server, the native `LSP` tool, or its CLI) reasons about your actual resolved build in `go.sum` (including `replace`d forks).
- "Where is `Foo` defined in my repo?" or "find every call site of this dependency's function in my code" → `golang-gopls` (`go_search`/`go_symbol_references`), not `golang-pkg-go-dev` — godig has no visibility into local, unpublished code or call sites inside your own repo.
- "Does this package I haven't added yet have known CVEs?" → `golang-pkg-go-dev` (`vulns`).
- "Can my current build actually reach a vulnerability in a dependency I already use?" → `golang-gopls` (`go_vulncheck`) or `golang-security` (`govulncheck` whole-tree).
See the `samber/cc-skills-golang@golang-gopls` skill for the full gopls reference, and the `samber/cc-skills-golang@golang-how-to` skill's "`godig` vs gopls vs Context7 vs govulncheck" section for the full breakdown.
---
+1 -1
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.5.0"
version: "1.5.1"
openclaw:
emoji: "🔄"
homepage: https://github.com/samber/cc-skills-golang
@@ -126,7 +126,7 @@ slog.Info("request handled", "method", r.Method, "status", status)
slog.Info("request handled", slog.String("method", r.Method), slog.Int("status", status))
```
**Migration guidance**: For existing projects heavily invested in third-party loggers, migration is optional. For new projects, prefer `slog`. The `samber/slog-*` ecosystem provides handlers for routing slog output to various backends. Go 1.24 added `slog.DiscardHandler` for silent loggers.
**Migration guidance**: For existing projects heavily invested in third-party loggers, migration is optional; for new projects, prefer `slog`. The `samber/slog-*` ecosystem provides handlers for routing slog output to various backends. Go 1.24 added `slog.DiscardHandler` for silent loggers.
### Use `slices` package instead of `sort` and manual loops _(Go 1.21+)_
@@ -415,7 +415,7 @@ type Result[T any] = struct { Value T; Err error }
### Use `os.Root` for directory-scoped file access _(Go 1.24+)_
**Security-critical**: `os.Root` prevents path traversal attacks (CWE-22) at the OS level. Replace all manual `filepath.Clean` + `strings.HasPrefix` validation with `os.Root` when handling user-supplied paths. Symlinks resolving outside the root are rejected. Supports `Open`, `Create`, `Stat`, `OpenFile`, `Mkdir`, `Remove`, and more.
**Security-critical**: `os.Root` prevents path traversal attacks (CWE-22) at the OS level. Replace all manual `filepath.Clean` + `strings.HasPrefix` validation with `os.Root` when handling user-supplied paths. It rejects symlinks resolving outside the root and supports `Open`, `Create`, `Stat`, `OpenFile`, `Mkdir`, `Remove`, and more.
```go
// Before: manual path validation (risk of path traversal)
@@ -703,7 +703,7 @@ For new encryption use, avoid `crypto/rsa.EncryptPKCS1v15`. Prefer RSA-OAEP (`rs
### Green Tea GC enabled by default _(Go 1.26+)_
Re-evaluate GC and allocation tuning under Go 1.26 Green Tea GC using profiles and benchmarks. Remove legacy tuning only when data supports it. Keep `GOMEMLIMIT` when it represents a real container or service memory ceiling. Remove third-party `automaxprocs` workarounds unless the project has a measured reason, because Go 1.25+ makes `GOMAXPROCS` container-aware by default.
Re-evaluate GC and allocation tuning under Go 1.26 Green Tea GC using profiles and benchmarks, removing legacy tuning only when data supports it. Keep `GOMEMLIMIT` when it represents a real container or service memory ceiling. Remove third-party `automaxprocs` workarounds unless the project has a measured reason, because Go 1.25+ makes `GOMAXPROCS` container-aware by default.
### Go 1.26+ test artifacts
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.1"
version: "1.3.2"
openclaw:
emoji: "📡"
homepage: https://github.com/samber/cc-skills-golang
@@ -55,7 +55,11 @@ When using observability libraries (Prometheus client, OpenTelemetry SDK, vendor
## Cross-References
See `samber/cc-skills-golang@golang-error-handling` skill for the single handling rule. See `samber/cc-skills-golang@golang-troubleshooting` skill for using observability signals to diagnose production issues. See `samber/cc-skills-golang@golang-security` skill for protecting pprof endpoints and avoiding PII in logs. See `samber/cc-skills-golang@golang-context` skill for propagating trace context across service boundaries. See `samber/cc-skills@promql-cli` skill for querying and exploring PromQL expressions against Prometheus from the CLI.
- → See `samber/cc-skills-golang@golang-error-handling` skill for the single handling rule.
- → See `samber/cc-skills-golang@golang-troubleshooting` skill for using observability signals to diagnose production issues.
- → See `samber/cc-skills-golang@golang-security` skill for protecting pprof endpoints and avoiding PII in logs.
- → See `samber/cc-skills-golang@golang-context` skill for propagating trace context across service boundaries.
- → See `samber/cc-skills@promql-cli` skill for querying and exploring PromQL expressions against Prometheus from the CLI.
### Go 1.26+: slog multi-handler
+1 -1
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.1"
version: "1.3.2"
openclaw:
emoji: "🏎"
homepage: https://github.com/samber/cc-skills-golang
+6 -1
View File
@@ -297,7 +297,12 @@ go build -tags=nosimd -o app-safe . # Fallback everywhere
- Auto-vectorization covers the most common cases (simple numeric loops)
- If your bottleneck is allocations or I/O, SIMD won't help
**Recommendation:** Start with auto-vectorization. For Go 1.27+, evaluate the portable `simd` package for cross-architecture code, or `simd/archsimd` for architecture-specific tuning (amd64, arm64, wasm) — remembering both are experimental. Move to runtime detection (option 2 above) if profiling shows a bottleneck and the code needs to run on heterogeneous hardware. Only use compile-time selection (option 3) if you control the deployment environment and can test each per-binary variant.
**Recommendation:**
- Start with auto-vectorization.
- For Go 1.27+, evaluate the portable `simd` package for cross-architecture code, or `simd/archsimd` for architecture-specific tuning (amd64, arm64, wasm) — remembering both are experimental.
- Move to runtime detection (option 2 above) if profiling shows a bottleneck and the code needs to run on heterogeneous hardware.
- Only use compile-time selection (option 3) if you control the deployment environment and can test each per-binary variant.
Only invest in hand-written SIMD when profiling shows a numeric inner loop consuming >20% of CPU and the compiler isn't auto-vectorizing it.
+2 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness. Requires the godig CLI (go install github.com/samber/godig/cmd/godig@latest) or access to a godig MCP server, and internet access to reach the pkg.go.dev API.
metadata:
author: samber
version: "1.4.1"
version: "1.4.2"
openclaw:
emoji: "🔎"
homepage: https://github.com/samber/cc-skills-golang
@@ -26,7 +26,7 @@ allowed-tools: Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(g
**Dependencies:** `godig``go install github.com/samber/godig/cmd/godig@latest` (or use a registered godig MCP server / the hosted instance instead).
`godig` queries the [pkg.go.dev](https://pkg.go.dev) API. Use it to answer questions about Go packages and modules: docs, symbols, versions, importers and vulnerabilities. It works as a CLI and as an MCP server. All operations are **read-only** and need no authentication.
`godig` queries the [pkg.go.dev](https://pkg.go.dev) API. Use it to answer questions about Go packages and modules: docs, symbols, versions, importers and vulnerabilities. It works as a CLI and as an MCP server, and all operations are **read-only** and need no authentication.
## When to use this skill
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "📚"
homepage: https://github.com/samber/cc-skills-golang
@@ -38,7 +38,11 @@ When recommending libraries, prioritize:
Find more libraries here: <https://github.com/avelino/awesome-go>
This skill is not exhaustive. Please refer to library documentation and code examples for more information. When exploring a candidate library, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) for docs, symbols, versions, importers, and known vulnerabilities — prefer it over Context7 for Go package facts. Once a candidate is added to your build, → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`) to browse its actual resolved source and compare candidates side by side. Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- When exploring a candidate library, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) for docs, symbols, versions, importers, and known vulnerabilities — prefer it over Context7 for Go package facts.
- Once a candidate is added to your build, → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`) to browse its actual resolved source and compare candidates side by side.
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## General Guidelines
@@ -204,7 +204,7 @@
## API Documentation
**swag** (<https://github.com/swaggo/swag>) Auto-generate OpenAPI/Swagger specs from Go code annotations. Parses comment-based annotations (`@Summary`, `@Param`, `@Success`, `@Router`, etc.) on handler functions to produce `swagger.json`/`swagger.yaml`. Integrates with Gin (`gin-swagger`), Echo (`echo-swagger`), Fiber (`fiber-swagger`), Chi, and net/http. Supports Swagger 2.0 and OpenAPI 3.x output.
**swag** (<https://github.com/swaggo/swag>) Auto-generate OpenAPI/Swagger specs from Go code annotations, parsing comment-based annotations (`@Summary`, `@Param`, `@Success`, `@Router`, etc.) on handler functions to produce `swagger.json`/`swagger.yaml`. Integrates with Gin (`gin-swagger`), Echo (`echo-swagger`), Fiber (`fiber-swagger`), Chi, and net/http, with Swagger 2.0 and OpenAPI 3.x output.
## Dependency Injection
+8 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.4.1"
version: "1.4.2"
openclaw:
emoji: "📁"
homepage: https://github.com/samber/cc-skills-golang
@@ -120,4 +120,10 @@ When starting a new Go project:
## Related Skills
→ See `samber/cc-skills-golang@golang-cli` skill for CLI tool structure and Cobra/Viper patterns. → See `samber/cc-skills-golang@golang-dependency-injection` skill for DI approach comparison and wiring. → See `samber/cc-skills-golang@golang-lint` skill for golangci-lint configuration. → See `samber/cc-skills-golang@golang-continuous-integration` skill for CI/CD pipeline setup. → See `samber/cc-skills-golang@golang-design-patterns` skill for architectural patterns. → See `samber/cc-skills-golang@golang-refactoring` skill for safely moving or splitting existing code into the layout above via type-alias gradual code repair and staged PRs, without a big-bang break. → See `samber/cc-skills-golang@golang-how-to` skill's Configure mode for the always-load directive and optional `## Required Go skills` block written to the project's agent-config file (CLAUDE.md, AGENTS.md, or equivalent).
- → See `samber/cc-skills-golang@golang-cli` skill for CLI tool structure and Cobra/Viper patterns.
- → See `samber/cc-skills-golang@golang-dependency-injection` skill for DI approach comparison and wiring.
- → See `samber/cc-skills-golang@golang-lint` skill for golangci-lint configuration.
- → See `samber/cc-skills-golang@golang-continuous-integration` skill for CI/CD pipeline setup.
- → See `samber/cc-skills-golang@golang-design-patterns` skill for architectural patterns.
- → See `samber/cc-skills-golang@golang-refactoring` skill for safely moving or splitting existing code into the layout above via type-alias gradual code repair and staged PRs, without a big-bang break.
- → See `samber/cc-skills-golang@golang-how-to` skill's Configure mode for the always-load directive and optional `## Required Go skills` block written to the project's agent-config file (CLAUDE.md, AGENTS.md, or equivalent).
+1 -1
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.1"
version: "1.3.2"
openclaw:
emoji: "🛡"
homepage: https://github.com/samber/cc-skills-golang
@@ -40,7 +40,7 @@ for _, v := range []string{"a", "b", "c"} {
### Go 1.22+: per-iteration scoping
Go 1.22 changed loop variable semantics — each iteration creates a new variable. The closure bug no longer occurs. However, if your module targets `go 1.21` or earlier in `go.mod`, the old behavior applies. Check your `go.mod` version.
Go 1.22 changed loop variable semantics — each iteration creates a new variable, so the closure bug no longer occurs. However, the old behavior applies if your module targets `go 1.21` or earlier in `go.mod` — check your `go.mod` version.
## Storing Pointer to Loop Variable
+11 -3
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.1"
version: "1.3.2"
openclaw:
emoji: "💉"
homepage: https://github.com/samber/cc-skills-golang
@@ -32,7 +32,11 @@ Type-safe dependency injection toolkit for Go based on Go 1.18+ generics.
- [do.samber.dev](https://do.samber.dev)
- [github.com/samber/do/v2](https://github.com/samber/do)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
Install v2 — v1 is superseded and lacks the generics-based container, scopes, and lifecycle hooks documented below, so v1-era guidance misleads on every API in this skill:
@@ -102,7 +106,11 @@ db, err := do.Invoke[Database](injector)
db := do.MustInvoke[Database](injector)
```
Inside a provider function, always use `do.MustInvoke` (or `MustInvokeAs`/`MustInvokeNamed`/`MustInvokeStruct`) rather than the error-returning variant. A provider already returns `(T, error)`, so propagating a dependency failure with `do.Invoke` costs an extra `if err != nil { return nil, err }` on every call. `do.MustInvoke` panics instead, but samber/do correctly catches and recovers that panic at the enclosing `Invoke` call and converts it back into a regular error — this recover happens inside the library itself, not in caller code, so `MustInvoke` is safe to use inside providers. The failure still surfaces as an error at the composition root, just without the manual boilerplate in every provider.
Inside a provider function, always use `do.MustInvoke` (or `MustInvokeAs`/`MustInvokeNamed`/`MustInvokeStruct`) rather than the error-returning variant:
- A provider already returns `(T, error)`, so propagating a dependency failure with `do.Invoke` costs an extra `if err != nil { return nil, err }` on every call.
- `do.MustInvoke` panics instead, but samber/do correctly catches and recovers that panic at the enclosing `Invoke` call and converts it back into a regular error — this recover happens inside the library itself, not in caller code, so `MustInvoke` is safe to use inside providers.
- The failure still surfaces as an error at the composition root, just without the manual boilerplate in every provider.
### 3. Service Dependencies
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.1.1"
version: "1.1.2"
openclaw:
emoji: "🔥"
homepage: https://github.com/samber/cc-skills-golang
@@ -31,7 +31,11 @@ Generic, type-safe in-memory caching library for Go 1.22+ with 9 eviction algori
- [pkg.go.dev/github.com/samber/hot](https://pkg.go.dev/github.com/samber/hot)
- [github.com/samber/hot](https://github.com/samber/hot)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
```bash
go get -u github.com/samber/hot
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "🧰"
homepage: https://github.com/samber/cc-skills-golang
@@ -32,7 +32,11 @@ Lodash-inspired, generics-first utility library with 500+ type-safe helpers for
- [lo.samber.dev](https://lo.samber.dev)
- [pkg.go.dev/github.com/samber/lo](https://pkg.go.dev/github.com/samber/lo)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## Why samber/lo
@@ -153,7 +153,7 @@ SIMD (Single Instruction Multiple Data) optimized operations for numeric types o
**Use when:** Bulk numeric operations after benchmarking confirms the bottleneck. Very specialized.
**Warning:** This package is experimental. API may break between minor versions. Not covered by semver stability guarantees. Do not use in production without version pinning.
**Warning:** This package is experimental and not covered by semver stability guarantees, so its API may break between minor versions. Do not use in production without version pinning.
## Decision Flowchart
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.1.1"
version: "1.1.2"
openclaw:
emoji: "🎭"
homepage: https://github.com/samber/cc-skills-golang
@@ -33,7 +33,11 @@ Go 1.18+ library providing type-safe monadic types with zero dependencies. Inspi
- [pkg.go.dev/github.com/samber/mo](https://pkg.go.dev/github.com/samber/mo)
- [github.com/samber/mo](https://github.com/samber/mo)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
```bash
go get github.com/samber/mo
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.0"
version: "1.2.1"
openclaw:
emoji: "💥"
homepage: https://github.com/samber/cc-skills-golang
@@ -36,7 +36,11 @@ Standard Go errors lack context — you see `connection failed` but not which us
- **Public messages** — user-safe messages separate from technical details
- **Low-cardinality messages** — variable data in `.With()` attributes, not the message string, so APM tools group errors properly
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## Core pattern: Error builder chain
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "👁"
homepage: https://github.com/samber/cc-skills-golang
@@ -34,7 +34,11 @@ Go implementation of [ReactiveX](https://reactivex.io/). Generics-first, type-sa
- [ro.samber.dev](https://ro.samber.dev)
- [pkg.go.dev/github.com/samber/ro](https://pkg.go.dev/github.com/samber/ro)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## Why samber/ro (Streams vs Slices)
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.1.1"
version: "1.1.2"
openclaw:
emoji: "🪵"
homepage: https://github.com/samber/cc-skills-golang
@@ -64,7 +64,11 @@ paths:
- [github.com/samber/slog-sampling](https://github.com/samber/slog-sampling) — throughput control
- [github.com/samber/slog-formatter](https://github.com/samber/slog-formatter) — attribute transformation
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## The Pipeline Model
@@ -52,7 +52,11 @@ handler := slogdatadog.Option{
defer handler.(interface{ Stop(context.Context) error }).Stop(context.Background()) // REQUIRED: flush buffered logs
```
**Batch mode** is the default — logs are buffered and sent periodically (default 5s). Call `Stop(ctx)` on shutdown or buffered logs are lost. The handler also exposes `Flush(ctx)` for mid-lifecycle flushes. For synchronous delivery, check the Option configuration.
**Batch mode** is the default — logs are buffered and sent periodically (default 5s):
- Call `Stop(ctx)` on shutdown or buffered logs are lost.
- `Flush(ctx)` triggers a mid-lifecycle flush.
- For synchronous delivery, check the Option configuration.
### Sentry — `slog-sentry`
+1 -1
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "🔒"
homepage: https://github.com/samber/cc-skills-golang
@@ -44,7 +44,7 @@ defer root.Close()
f, err := root.Open(filename) // cannot escape root directory
```
`os.Root` prevents ordinary path traversal at the OS level. All operations (`Open`, `Create`, `Stat`, `OpenFile`, etc.) are confined to the root directory, and symlinks that resolve outside the root are rejected. It is not a full sandbox: it does not by itself block bind mounts, special device files, or all `/proc`-style filesystem behavior. For archive extraction and uploads, still reject special files and choose a root without attacker-controlled mounts.
`os.Root` prevents ordinary path traversal at the OS level — all operations (`Open`, `Create`, `Stat`, `OpenFile`, etc.) are confined to the root directory, and symlinks that resolve outside the root are rejected. It is not a full sandbox: it does not by itself block bind mounts, special device files, or all `/proc`-style filesystem behavior. For archive extraction and uploads, still reject special files and choose a root without attacker-controlled mounts.
**Good (pre-Go 1.24 fallback):**
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.1.1"
version: "1.1.2"
openclaw:
emoji: "🐍"
homepage: https://github.com/samber/cc-skills-golang
@@ -38,7 +38,11 @@ Cobra is the de facto standard for Go CLI applications. It provides the command/
- [github.com/spf13/cobra](https://github.com/spf13/cobra)
- [cobra.dev](https://cobra.dev)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
```bash
go get github.com/spf13/cobra@latest
+12 -4
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.1.1"
version: "1.1.2"
openclaw:
emoji: "🔧"
homepage: https://github.com/samber/cc-skills-golang
@@ -31,7 +31,11 @@ Viper resolves configuration values from multiple sources in a fixed precedence
- [pkg.go.dev/github.com/spf13/viper](https://pkg.go.dev/github.com/spf13/viper)
- [github.com/spf13/viper](https://github.com/spf13/viper)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
```bash
go get github.com/spf13/viper@latest
@@ -39,7 +43,11 @@ go get github.com/spf13/viper@latest
## Viper vs. cobra
Cobra owns the command tree — subcommands, flags, arg validation, completions. Viper owns configuration resolution — it answers "what is the value of key X?" by walking its source layers. Viper has no user-facing surface; it is purely a key-value resolver. Use cobra alone for flag-only CLIs; viper alone for config-file daemons; both when you need both, binding flags at `PersistentPreRunE` via `BindPFlag`.
Cobra owns the command tree — subcommands, flags, arg validation, completions. Viper owns configuration resolution — it answers "what is the value of key X?" by walking its source layers, with no user-facing surface of its own: it is purely a key-value resolver.
- **Cobra alone** — flag-only CLIs.
- **Viper alone** — config-file daemons.
- **Both** — bind flags at `PersistentPreRunE` via `BindPFlag`.
→ See `samber/cc-skills-golang@golang-spf13-cobra` for the cobra side of this integration.
@@ -134,7 +142,7 @@ viper.WatchConfig()
viper.OnConfigChange(func(e fsnotify.Event) { /* re-apply changed values */ })
```
`WatchConfig` uses fsnotify and watches inodes. Editors that write atomically via rename (vim, neovim) replace the inode the callback may not fire. Test hot-reload with `echo >> config.yaml`, not editor saves. For race-safe reload patterns, see [watch-and-reload.md](references/watch-and-reload.md).
`WatchConfig` uses fsnotify and watches inodes, so editors that write atomically via rename (vim, neovim) replace the inode and the callback may not fire. Test hot-reload with `echo >> config.yaml`, not editor saves. For race-safe reload patterns, see [watch-and-reload.md](references/watch-and-reload.md).
## Test isolation
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.3.0"
version: "1.3.1"
openclaw:
emoji: "✅"
homepage: https://github.com/samber/cc-skills-golang
@@ -35,7 +35,11 @@ paths:
testify complements Go's `testing` package with readable assertions, mocks, and suites. It does not replace `testing` — always use `*testing.T` as the entry point.
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
## assert vs require
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness. Requires go and swag CLI.
metadata:
author: samber
version: "1.1.1"
version: "1.1.2"
openclaw:
emoji: "📋"
homepage: https://github.com/samber/cc-skills-golang
@@ -225,6 +225,10 @@ type CreateUserRequest struct {
- → See `samber/cc-skills-golang@golang-security` for securing the Swagger UI endpoint in production (disable or gate with auth middleware).
- → See `samber/cc-skills-golang@golang-grpc` for gRPC — use grpc-gateway with its own OpenAPI generator instead of swag.
This skill is not exhaustive. Refer to the swaggo/swag documentation and code examples for up-to-date API signatures and usage patterns. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive — refer to the swaggo/swag documentation and code examples for up-to-date API signatures and usage patterns:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
If you encounter a bug or unexpected behavior in swag, open an issue at <https://github.com/swaggo/swag/issues>.
+7 -3
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "⛏"
homepage: https://github.com/samber/cc-skills-golang
@@ -31,7 +31,11 @@ Reflection-based DI toolkit, designed to power application frameworks (it is the
- [pkg.go.dev/go.uber.org/dig](https://pkg.go.dev/go.uber.org/dig)
- [github.com/uber-go/dig](https://github.com/uber-go/dig)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
```bash
go get go.uber.org/dig
@@ -82,7 +86,7 @@ err = c.Invoke(func(db *sql.DB) error {
Constructors are **lazy** and **memoized**: each output type is built once and shared (singleton per container). `Provide` errors at registration if the constructor is malformed; `Invoke` returns the constructor's error wrapped with the dependency path that triggered it.
A dig constructor is any function. Inputs are dependencies, outputs are provided types. `error` (last return) signals construction failure. Follow "accept interfaces, return structs".
A dig constructor is any function whose inputs are dependencies and whose outputs are provided types. `error` (last return) signals construction failure. Follow "accept interfaces, return structs".
## Parameter Objects with `dig.In`
+6 -2
View File
@@ -6,7 +6,7 @@ license: MIT
compatibility: Designed for Claude Code, Codex or similar harness, and for projects using Golang.
metadata:
author: samber
version: "1.2.1"
version: "1.2.2"
openclaw:
emoji: "🏭"
homepage: https://github.com/samber/cc-skills-golang
@@ -32,7 +32,11 @@ Application framework combining a reflection-based DI container (built on `uber-
- [uber-go.github.io/fx](https://uber-go.github.io/fx/)
- [github.com/uber-go/fx](https://github.com/uber-go/fx)
This skill is not exhaustive. Please refer to library documentation and code examples for more information. For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`) — prefer it over Context7 for Go package facts. To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`). Context7 remains a fallback for docs not indexed on pkg.go.dev.
This skill is not exhaustive refer to library documentation and code examples for more information:
- For Go package docs, symbols, versions, importers, and known vulnerabilities, → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`), preferred over Context7 for Go package facts.
- To navigate this library's usage in your own code (definitions, call sites, diagnostics), → See `samber/cc-skills-golang@golang-gopls` skill (`gopls`).
- Context7 remains a fallback for docs not indexed on pkg.go.dev.
```bash
go get go.uber.org/fx