A Claude Code skill carrying a field-tested Go engineering playbook. Every entry was learned debugging real production code; dates in the text are provenance stamps for when a claim was verified.
| Section | Covers |
|---|---|
| JSON serialization | Nil slices/maps marshaling to null, decimal-as-string |
| Control flow | log.Fatalf vs defers, named returns, defer recover() placement |
| Linting | gocritic/gosec/staticcheck finding classes, fix cascades, false-positive patterns, version-bump surprises |
| Routing | http.ServeMux wildcard panics, validating UUID path params |
| Tooling | go mod graph vs go list -deps for real vulnerability scope, +incompatible semantics |
| Standard library quirks | time.LoadLocation(""), url.Parse leniency, userinfo percent-encoding |
| Tests + mocks | Internal test packages, lean func-field mocks, coverage targeting, two coverage false-green patterns |
| httptest | Request-building traps with hostile payloads |
| HTTP security | X-Forwarded-For trust, WebSocket origin checks (CSWSH), token-in-URL leaks |
| SQL injection | The grep that catches what gosec G201 misses |
| pgx / Vault / Prometheus / WebAuthn | Pool-scoped tenant sessions, Transit idempotency, metric labeling, passkey backup flags |
| Build | Verifying -ldflags -X symbol paths by marker injection |
As a user-level skill (available in every project):
git clone https://github.com/Corvalon/skill-go.git ~/.claude/skills/skill_goOr as a project-level skill:
git clone https://github.com/Corvalon/skill-go.git <your-repo>/.claude/skills/skill_goClaude Code discovers SKILL.md automatically and loads it when a session starts working in Go
code, fixing lint findings, or auditing HTTP handlers.
MIT. See LICENSE.