external/cc-skills-golang/golang-pkg-go-dev/SKILL.md
Golang package and module documentation and exploration via `godig`, a pkg.go.dev API client (CLI + MCP server) — package docs, API references, symbols, code examples, available versions, importers (who imports a package), licenses, and known vulnerabilities. Read-only, no auth. Use for looking up any Go/Golang library's documentation, API signatures, usage examples, which versions exist, whether a dependency has CVEs, or who imports a package — prefer this over Context7 for any Go package or module. Triggers on: how to use a Go library, Go API docs, import usage, code examples, pkg.go.dev. Not for upgrading dependencies (→ See `samber/cc-skills-golang@golang-dependency-management` skill) or choosing a library (→ See `samber/cc-skills-golang@golang-popular-libraries` skill). Not for local symbols, or for navigating an already-used dependency's resolved source, call sites, or generic instantiations — → See `samber/cc-skills-golang@golang-gopls` skill for those.
npx skillsauth add seikaikyo/dash-skills golang-pkg-go-devInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Dependencies: godig — go install github.com/samber/godig/cmd/godig@latest (or use a registered godig MCP server / the hosted instance instead).
godig queries the pkg.go.dev API. Use it to answer questions about Go packages and modules: docs, symbols, versions, importers and vulnerabilities. It works as a CLI and as an MCP server. All operations are read-only and need no authentication.
Trigger on questions like:
godig, gopls, Context7, and govulncheckIn short: godig answers questions about the published ecosystem (works even for packages not yet in your go.mod); gopls reasons about your locally resolved build (go.sum, including replaced forks); Context7 is a fallback for non-Go or unindexed docs; govulncheck is the whole-tree vulnerability audit (→ samber/cc-skills-golang@golang-security). See the samber/cc-skills-golang@golang-gopls skill for wiring gopls (MCP server, native LSP tool, and CLI) with Claude Code, and the samber/cc-skills-golang@golang-how-to skill's "godig vs gopls vs Context7 vs govulncheck" section for the full task-to-tool matrix.
go install github.com/samber/godig/cmd/godig@latest
godig mcp runs over stdio by default, or streamable HTTP with --transport http.
stdio (the client launches godig on demand):
claude mcp add pkg-go-dev -- godig mcp
streamable HTTP (shared server at /mcp, default :8080):
godig mcp --transport http --addr :8080
claude mcp add --transport http pkg-go-dev http://localhost:8080/mcp
Hosted instance (no install needed) — a public server runs at https://godig.samber.dev/mcp:
claude mcp add --transport http pkg-go-dev https://godig.samber.dev/mcp
The CLI and the MCP server expose the same operations under matching names. Prefer the CLI when godig is installed; the hosted instance is a fallback when it is not.
Global flags (all commands): -o/--output table|json|raw|md (default table — pass -o md for chat), --base-url (pkg.go.dev API), --vuln-base-url (Go vulnerability database, consulted by vulns and overview), --timeout, --log-level debug|info|warn|error|off. All are also settable via GODIG_* env vars.
| Command | Args | Specific flags | Purpose |
| --- | --- | --- | --- |
| overview | <path> | --version | Compact summary (metadata, versions, licenses, vulns) — start here |
| search | <query> | --symbol --limit --filter | Find packages (optionally exporting a symbol) |
| package info | <path> | --module --version | Package metadata |
| package imports | <path> | --module --version | Packages this package imports (plain list) |
| package doc | <path> | --module --version --goos --goarch --format md\|text\|html\|markdown | Full package doc (LARGE) |
| package examples | <path> | --module --version --goos --goarch --symbol | Runnable examples (LARGE; scope with --symbol) |
| package licenses | <path> | --module --version | License files, full text (LARGE) |
| symbol doc | <path> <symbol> | --module --version --goos --goarch | One symbol's signature + doc (token-efficient) |
| symbol examples | <path> <symbol> | --module --version --goos --goarch | One symbol's runnable examples |
| symbols | <path> | --module --version --goos --goarch --limit --filter | List exported symbols |
| module info | <path> | --version | Module metadata |
| module licenses | <path> | --version | Module license files (LARGE) |
| module readme | <path> | --version | Module README, full Markdown (LARGE) |
| dependencies | <path> | --version | go.mod deps: requires / replaces / excludes / go directive |
| packages | <path> | --version --limit --filter | Packages contained in a module |
| versions | <path> | --limit --filter | All versions, newest first |
| major-versions | <path> | --limit --filter --exclude-pseudo | Major versions (v1, v2 …) living as separate modules |
| imported-by | <path> | --module --version --limit --filter | Packages that import this one |
| vulns | <path> | --version --limit | Known vulnerabilities (from the Go vuln DB) |
| mcp | — | --transport stdio\|http --addr --cache-ttl --cache-size | Run as an MCP server |
| version | — | — | Print godig version / commit / build date |
When godig runs as an MCP server, each data command above is exposed as an operation of the same name.
Exit codes: 0 success, 1 runtime error (network, package not found), 2 usage error — a missing/invalid argument or flag (e.g. a non-positive --limit), or a command group invoked with no subcommand (godig package). Check for 2 to tell a malformed call apart from a failed lookup.
Full -o md output for every command: sample-output.md.
overview — one call returns a compact summary (metadata, latest + recent versions, license types, vulnerabilities). Reach for doc/examples/module readme/licenses (LARGE) only when the full text is needed.-o md so results render as Markdown (tables, or raw doc/README) in the chat. Other formats exist (table default, json, raw) but prefer md here.<path> is a full import path, e.g. github.com/samber/lo — pass it as the positional argument.--version pins a specific module version (v1.5.0, latest, master, main); --module disambiguates which module a package belongs to.--filter narrows list results server-side with a Go boolean expression — see Filter syntax.--goos/--goarch set the documentation/symbols build context (e.g. linux/amd64).symbol doc/symbol examples over the package-wide package doc/package examples when you only need one symbol — far fewer tokens.godig invocations in a single turn) rather than one after another — wall-clock drops from sum-of-latencies to slowest-single-call. For a large fan-out (documenting many symbols, comparing many candidate libraries, auditing CVEs across a dependency set), dispatch parallel sub-agents (up to 5) via the Agent tool, each running its own godig calls and returning a compact summary, so the raw LARGE output never lands in the main context.--limit to cap.--filter (on search, versions, major-versions, packages, imported-by, symbols) takes a Go boolean expression evaluated server-side, once per result item. It is not a regex — wrap the whole expression in single quotes for the shell.
search exposes packagePath, not path). An unknown field fails with undefined identifier: <name> (HTTP 400), which names the offending field. Fields use the item's lowercase JSON key; the exception is enum-like values such as kind, which are capitalized (Function, not func).== != < <= > >=, boolean && || !, parentheses for grouping.contains(s, sub), hasPrefix(s, pre), hasSuffix(s, suf)."Function"), true/false, numbers.Filterable fields per command (string unless noted):
| Command | Fields |
| --- | --- |
| search | modulePath, packagePath, synopsis, version |
| versions | version, modulePath, deprecated (bool), retracted (bool), hasGoMod (bool), commitTime |
| packages | path, name, synopsis, isRedistributable (bool) |
| imported-by | path (the importing package path) |
| symbols | name, kind (Function/Method/Type/Variable/Constant), synopsis, parent |
| major-versions | modulePath, major, version, isLatest (bool) |
godig symbols github.com/samber/lo --filter 'kind=="Function"' -o md
godig symbols github.com/samber/lo --filter 'kind=="Function" && hasPrefix(name,"Map")' -o md
godig versions github.com/samber/lo --filter 'hasPrefix(version,"v1.5")' -o md
godig versions github.com/samber/lo --filter 'deprecated==false && retracted==false' -o md
godig search "result option" --filter 'hasPrefix(packagePath,"github.com/samber/")' -o md
Always request Markdown output (-o md):
# Overview — start here (compact, one call)
godig overview github.com/samber/ro -o md
# Search
godig search "result option monad" --limit 5 -o md
# Package facets
godig package info github.com/samber/ro -o md
godig package imports github.com/samber/ro -o md
godig package doc github.com/samber/ro --format md -o md
godig package examples github.com/samber/ro --symbol Map -o md
godig package licenses github.com/samber/ro -o md
# Single symbol (token-efficient vs package-wide doc/examples)
godig symbol doc github.com/samber/lo Map -o md
godig symbol examples github.com/samber/oops OopsError.Error -o md
# Module facets
godig module info github.com/samber/ro -o md
godig module readme github.com/samber/ro -o raw
godig dependencies github.com/samber/ro -o md
# Lists (auto-paginated; --limit to cap)
godig versions github.com/samber/ro -o md
godig major-versions github.com/samber/lo -o md
godig packages github.com/samber/ro -o md
godig imported-by github.com/samber/ro --limit 20 -o md
godig symbols github.com/samber/ro --filter 'kind=="Function"' -o md
# Pin a version / set the build context
godig versions github.com/samber/ro --filter 'hasPrefix(version,"v0.3")' -o md
godig package doc github.com/samber/lo --version v1.50.0 -o md
godig symbols github.com/samber/ro --goos linux --goarch amd64 -o md
# Vulnerabilities
godig vulns github.com/samber/ro -o md
This skill is not exhaustive. godig --help and each sub-command's --help list current flags and output formats; the data mirrors what pkg.go.dev exposes.
If you encounter a bug or unexpected behavior in godig, open an issue at https://github.com/samber/godig/issues.
tools
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
development
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
testing
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.