New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Go Defensive

by cxuu in cxuu/golang-skills

A skill your agent uses when hardening Go code at API boundaries — copying slices/maps, verifying interface compliance, using defer for cleanup, time.Time/time.Duration, or avoiding mutable globals.

Apache-2.0Auto-check passedDevelopment

Install Go Defensive

skills CLI
$ npx skills add cxuu/golang-skills --skill go-defensive -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cxuu/golang-skills go-defensive --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cxuu/golang-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/go-defensive .claude/skills/go-defensive && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
go-defensive
GitHub stars
172
Token cost
~1.6k tokens
SKILL.md length
511 words
Files
6 (incl. references)
Skills in repo
20
Repo updated
First seen
Licence
Apache-2.0

At a glance

A skill your agent uses when hardening Go code at API boundaries — copying slices/maps, verifying interface compliance, using defer for cleanup, time.Time/time.Duration, or avoiding mutable globals.

  • Hardening Go code at API boundaries — copying slices/maps
  • SKILL.md covers Resource Routing, Defensive Checklist Priority, Quick Reference and Verify Interface Compliance, plus 10 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Verifying interface compliance

What it does

Go Defensive is an agent skill from cxuu/golang-skills. Use when hardening Go code at API boundaries — copying slices/maps, verifying interface compliance, using defer for cleanup, time.Time/time.Duration, or avoiding mutable globals. Also use when reviewing for robustness concerns like missing cleanup or unsafe crypto usage, even if the user doesn't mention "defensive programming." Does not cover error handling strategy (see go-error-handling).

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including reference files (for example `references/BOUNDARY-COPYING.md`, `references/GLOBAL-STATE.md` and `references/MUST-FUNCTIONS.md`).

It sits in Development. The repository describes itself as: AI Agent Skills for idiomatic, production-ready Go code, distilled from Google, Uber, Community. The licence is Apache-2.0.

When your agent uses it

  • Hardening Go code at API boundaries — copying slices/maps
  • Verifying interface compliance
  • Using defer for cleanup
  • Time.Time/time.Duration

Example prompts

  • “t mention”
  • “/go-defensive”

What it can do on your machine

Read from SKILL.md and the folder at commit 91f0c2e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are go).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Go Defensive loads about 1.6k tokens when it runs, and up to ~5.5k if it reads all its reference files. Until then it costs about 102 tokens; SKILL.md has 511 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~102
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~5.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cxuu/golang-skills at commit 91f0c2e, republished under its Apache-2.0 licence (© cxuu). 511 words, ~1,637 tokens.

Download SKILL.mdSave it as .claude/skills/go-defensive/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
go-defensive
description
Use when hardening Go code at API boundaries — copying slices/maps, verifying interface compliance, using defer for cleanup, time.Time/time.Duration, or avoiding mutable globals. Also use when reviewing for robustness concerns like missing cleanup or unsafe crypto usage, even if the user doesn't mention "defensive programming." Does not cover error handling strategy (see go-error-handling).

Go Defensive Programming Patterns

Compatibility: Crypto examples may use crypto/rand.Text, which requires Go 1.24+.

Resource Routing

  • references/BOUNDARY-COPYING.md - Read when copying slices/maps across API boundaries.
  • references/GLOBAL-STATE.md - Read when introducing or removing package globals.
  • references/MUST-FUNCTIONS.md - Read when deciding whether a panic-on-error helper is acceptable.
  • references/PANIC-RECOVER.md - Read when evaluating panic, recover, or crash containment.
  • references/TIME-ENUMS-TAGS.md - Read when handling time types, enum zero values, or struct tags.

Defensive Checklist Priority

When hardening code at API boundaries, check in this order:

Reviewing an API boundary?
├─ 1. Error handling     → Return errors; don't panic (see go-error-handling)
├─ 2. Input validation   → Copy slices/maps received from callers
├─ 3. Output safety      → Copy slices/maps before returning to callers
├─ 4. Resource cleanup   → Use defer for Close/Unlock/Cancel
├─ 5. Interface checks   → Route compile-time assertions to go-interfaces
├─ 6. Time correctness   → Use time.Time and time.Duration, not int/float
├─ 7. Enum safety        → Start iota at 1 so zero-value is invalid
└─ 8. Crypto safety      → crypto/rand for keys, never math/rand

Quick Reference

PatternRuleDetails
Boundary copiesCopy slices/maps on receive and returnBOUNDARY-COPYING.md
Defer cleanupdefer f.Close() right after os.OpenBelow
Interface checkCompile-time satisfaction assertionSee go-interfaces
Time typestime.Time / time.Duration, never raw intTIME-ENUMS-TAGS.md
Enum startiota + 1 so zero = invalidBelow
Crypto randcrypto/rand for keys, never math/randBelow
Must functionsOnly at init; panic on failureMUST-FUNCTIONS.md
Panic/recoverNever expose panics across packagesPANIC-RECOVER.md
Mutable globalsReplace with dependency injectionBelow

Verify Interface Compliance

Route compile-time interface assertions to go-interfaces. Use this skill only to notice API-boundary robustness risk; the interface skill owns when an assertion is appropriate and the exact assertion shape.

Copy Slices and Maps at Boundaries

Slices and maps contain pointers to underlying data. Copy at API boundaries to prevent unintended modifications.

go
// Receiving: copy incoming slice
d.trips = make([]Trip, len(trips))
copy(d.trips, trips)

// Returning: copy map before returning
result := make(map[string]int, len(s.counters))
for k, v := range s.counters { result[k] = v }

Defer to Clean Up

Use defer to clean up resources (files, locks). Avoids missed cleanup on multiple return paths.

go
p.Lock()
defer p.Unlock()

if p.count < 10 {
  return p.count
}
p.count++
return p.count

Defer overhead is negligible. Place defer f.Close() immediately after os.Open for clarity. Arguments to deferred functions are evaluated when defer executes, not when the function runs. Multiple defers execute in LIFO order.

Struct Field Tags

Advisory: Always add explicit field tags to structs that are marshaled or unmarshaled.

go
type User struct {
    Name  string `json:"name"  yaml:"name"`
    Email string `json:"email" yaml:"email"`
}

Field tags are a serialization contract — renaming a struct field without updating the tag silently breaks wire compatibility. Treat tags as part of the public API for any type that crosses a serialization boundary.

Show full SKILL.md (204 more words)Show less

Start Enums at One

Start enums at non-zero to distinguish uninitialized from valid values.

go
const (
  Add Operation = iota + 1  // Add=1, zero value = uninitialized
  Subtract
  Multiply
)

Exception: When zero is the sensible default (e.g., LogToStdout = iota).

Time, Struct Tags, and Embedding

Avoid Mutable Globals

Inject dependencies instead of mutating package-level variables. This makes code testable without global save/restore.

go
type signer struct {
  now func() time.Time  // injected; tests replace with fixed time
}

func newSigner() *signer {
  return &signer{now: time.Now}
}

Crypto Rand

Do not use math/rand or math/rand/v2 to generate keys — this is a security concern. Time-seeded generators have predictable output.

go
import "crypto/rand"

func Key() string { return rand.Text() }

For text output, use crypto/rand.Text directly, or encode random bytes with encoding/hex or encoding/base64.

Panic and Recover

Use panic only for truly unrecoverable situations. Library functions should avoid panic.

go
func safelyDo(work *Work) {
    defer func() {
        if err := recover(); err != nil {
            log.Println("work failed:", err)
        }
    }()
    do(work)
}

Key rules:

  • Never expose panics across package boundaries — always convert to errors
  • Acceptable to panic in init() if a library truly cannot set itself up
  • Use recover to isolate panics in server goroutine handlers

Must Functions

Must functions panic on error — use them only during program initialization where failure means the program cannot run.

go
var validID = regexp.MustCompile(`^[a-z][a-z0-9-]{0,62}$`)
var tmpl = template.Must(template.ParseFiles("index.html"))
  • Error handling: See go-error-handling when choosing between returning errors and panicking, or wrapping errors at boundaries
  • Concurrency safety: See go-concurrency when protecting shared state with mutexes, atomics, or channels
  • Interface checks: See go-interfaces when adding compile-time interface satisfaction checks
  • Data structure copying: See go-data-structures when working with slice/map internals or pointer aliasing

© cxuu, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (references) in skills/go-defensive of cxuu/golang-skills.

  • SKILL.md
  • references/BOUNDARY-COPYING.md
  • references/GLOBAL-STATE.md
  • references/MUST-FUNCTIONS.md
  • references/PANIC-RECOVER.md
  • references/TIME-ENUMS-TAGS.md

Open the folder on GitHubat commit 91f0c2e

Compare with similar skills

Go Defensive next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Go Defensive compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Go Defensive this skillcxuu/golang-skills172—~1.6kAutomated safety check: PassApache-2.0
Vercel Composition Patternssupabase/supabase111k58 repos~726Automated safety check: PassMIT
Finishing a Development Branchobra/superpowers297k5 repos~1.9kAutomated safety check: PassMIT
Typescript Advanced Typesrolling-scopes/rsschool-app10k25 repos~4.2kAutomated safety check: PassMPL-2.0
PR Babysitteropeninterpreter/openinterpreter69k3 repos~4.2kAutomated safety check: PassApache-2.0
Code Review ChecklistshareAI-lab/learn-claude-code78k5 repos~1.1kAutomated safety check: PassMIT

Similar skills

  • Vercel Composition Patterns

    supabase/supabase

    Official

    React composition patterns that scale. An agent skill from supabase/supabase.

    111k GitHub starsUsed in 58 repos~726 tokens
    DevelopmentAuto-check passed

  • Finishing a Development Branch

    obra/superpowers

    Walks the last step of a branch: confirm tests pass, detect the git environment, ask how to integrate, carry out your choice and clean up the worktree.

    297k GitHub starsUsed in 5 repos~1.9k tokens
    DevelopmentAuto-check passed

  • Typescript Advanced Types

    rolling-scopes/rsschool-app

    Master TypeScript's advanced type system including generics, conditional types, mapped types, template literals, and utility types for building type-safe applications.

    10k GitHub starsUsed in 25 repos~4.2k tokens
    DevelopmentAuto-check passed

  • PR Babysitter

    openinterpreter/openinterpreter

    Watches an open GitHub pull request until it merges, handling review comments, diagnosing CI failures and retrying flaky checks along the way.

    69k GitHub starsUsed in 3 repos~4.2k tokens
    DevelopmentAuto-check passed

  • Code Review Checklist

    shareAI-lab/learn-claude-code

    Reviews code against a five-part checklist covering security, correctness, performance, maintainability and testing, and reports findings in a fixed format.

    78k GitHub starsUsed in 5 repos~1.1k tokens
    DevelopmentAuto-check passed

  • Greploop

    onyx-dot-app/onyx

    Iteratively improves a PR (GitHub), MR (GitLab), or shelved changelist (Perforce) until Greptile gives it a 5/5 confidence score with zero unresolved comments.

    32k GitHub starsUsed in 4 repos~3.3k tokens
    DevelopmentAuto-check passed

More from cxuu/golang-skills

All 20 skills in this repo

  • Go Testing

    cxuu/golang-skills

    A skill your agent uses when writing, reviewing, or improving Go test code — including table-driven tests, subtests, parallel tests, test helpers, test doubles, and assertions with cmp.Diff.

    172 GitHub starsUsed in 1 repo~1.3k tokens
    Auto-check passed

  • Go Code Review

    cxuu/golang-skills

    A skill your agent uses when reviewing Go code or checking code against community style standards.

    172 GitHub stars~2.7k tokensUpdated 3 mo ago
    Auto-check passed

  • Go Performance

    cxuu/golang-skills

    A skill your agent uses when optimizing Go code, investigating slow performance, or writing performance-critical sections.

    172 GitHub starsUsed in 1 repo~1.3k tokens
    Auto-check passed

  • Go Documentation

    cxuu/golang-skills

    A skill your agent uses when writing or reviewing documentation for Go packages, types, functions, or methods.

    172 GitHub stars~1.3k tokensUpdated 3 mo ago
    Auto-check passed

  • Go Error Handling

    cxuu/golang-skills

    A skill your agent uses when writing Go code that returns, wraps, or handles errors — choosing between sentinel errors, custom types, and fmt.Errorf (%w vs %v), structuring error flow, or deciding…

    172 GitHub stars~1.5k tokensUpdated 3 mo ago
    Auto-check passed

  • Go Interfaces

    cxuu/golang-skills

    A skill your agent uses when defining or implementing Go interfaces, designing abstractions, creating mockable boundaries for testing, or composing types through embedding.

    172 GitHub stars~1.4k tokensUpdated 3 mo ago
    Auto-check passed

Categories

Questions about Go Defensive

What does Go Defensive do?

A skill your agent uses when hardening Go code at API boundaries — copying slices/maps, verifying interface compliance, using defer for cleanup, time.Time/time.Duration, or avoiding mutable globals. Go Defensive is an agent skill from cxuu/golang-skills.Duration, or avoiding mutable globals.

When should I use Go Defensive?

Go Defensive fits situations like: hardening Go code at API boundaries — copying slices/maps; verifying interface compliance; using defer for cleanup; time.Time/time.Duration.

How do I install Go Defensive in Claude Code?

Run `npx skills add cxuu/golang-skills --skill go-defensive -a claude-code`. Or copy the skill folder (skills/go-defensive in cxuu/golang-skills) into .claude/skills/go-defensive in your project. Claude Code loads it when a task matches its description.

How do I install Go Defensive in Codex?

Run `npx skills add cxuu/golang-skills --skill go-defensive -a codex`. Or copy the skill folder (skills/go-defensive in cxuu/golang-skills) into .agents/skills/go-defensive in your project. Codex loads it when a task matches its description.

Can I use Go Defensive in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cxuu/golang-skills --skill go-defensive -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/go-defensive, .gemini/skills/go-defensive, .github/skills/go-defensive and .opencode/skills/go-defensive in your project.

What does Go Defensive need to run?

SKILL.md names no scripts, command-line tools or credentials: Go Defensive is instructions for the agent only.

Does Go Defensive access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Go Defensive safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Go Defensive use?

Go Defensive is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Go Defensive use?

About 1.6k tokens (SKILL.md is roughly 6.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.9k tokens, read only when the agent opens those files.

What are the alternatives to Go Defensive?

Skills that share tags, products or a category with Go Defensive: Vercel Composition Patterns (supabase/supabase, 111k stars), Finishing a Development Branch (obra/superpowers, 297k stars), Typescript Advanced Types (rolling-scopes/rsschool-app, 10k stars) and PR Babysitter (openinterpreter/openinterpreter, 69k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Go Defensive?

cxuu (a GitHub user) maintains it in cxuu/golang-skills, which has 172 GitHub stars. The repository holds 20 skills in this directory. The repository was last updated on June 20, 2026.

Source: cxuu/golang-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.