Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →samber/golang-dependency-management
Dependency management strategies for Golang projects — go.mod management, installing/upgrading packages, Minimal Version Selection, vulnerability scanning, outdated dependency tracking, binary size analysis, Dependabot/Renovate setup, conflict resolution, and go.work workspaces.
Passed 23 of 23 test cases with the skill, and 18 of 23 without it.
and 2 more in the full report
5 fixed18 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
Before creating a git commit that adds or updates third-party imports in Go files, what command must always be run to ensure unused modules are removed and missing modules are added?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends running go mod tidy before committing | Missed | Passed |
The instructions your model reads when the skill loads.
Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.
Dependencies:
go install golang.org/x/vuln/cmd/govulncheck@latestBefore running go get to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using go get -u to upgrade an existing dependency is safe.
Before proposing a dependency, evaluate:
The samber/cc-skills-golang@golang-popular-libraries skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (golang.org/x/...) or established organizations over obscure alternatives.
go.sum MUST be committed — it records cryptographic checksums of every dependency version, letting go mod verify detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious codegovulncheck ./... or go tool govulncheck ./... before every release — catches known CVEs in your dependency tree before they reach productiongo mod tidy before every commit that changes dependencies — removes unused modules and adds missing ones, keeping go.mod honest| Command | Purpose |
|---|---|
go mod tidy | Add missing deps, remove unused ones |
go mod download | Download modules to local cache |
go mod verify | Verify cached modules match go.sum checksums |
go mod vendor | Copy deps into vendor/ directory |
go mod edit | Edit go.mod programmatically (scripts, CI) |
go mod graph | Print the module requirement graph |
test cases passed, vs 18 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.