Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Scans Go modules for known security vulnerabilities using govulncheck, identifies affected dependencies, and guides remediation through updates, replacements, or removals. Covers both direct and transitive dependencies, with verification steps to confirm fixes without breaking builds.
govulncheck uses the Go vulnerability database and call graph analysis to report only vulnerabilities reachable in your code, reducing noise compared to generic dependency scanners.
When to use it
- Auditing a Go project before a production release
- Fixing a flagged CVE in a transitive dependency
- Checking whether a vulnerable function is actually called in your code
- Updating JWT libraries after a security advisory
- Setting up a routine vulnerability scan in a Go monorepo
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: scan my Go project for vulnerabilities and fix any found
- 1Run govulncheck ./... to detect vulnerabilities in the module
- 2Review CVE details and confirm which vulnerable functions are called
- 3Update affected packages with go get -u and run go mod tidy
- 4Re-run govulncheck ./... to confirm no vulnerabilities remain
- 5Run go build ./... and go test ./... to verify nothing is broken
Clean govulncheck output with zero findings, successful build, and passing tests