Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fusengine/agents --skill go-tooling-securitygit clone --depth 1 https://github.com/fusengine/agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fusengine/agents/go-tooling-security)<a href="https://agentmods.dev/skills/fusengine/agents/go-tooling-security"><img src="https://agentmods.dev/badge/skills/fusengine/agents/go-tooling-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fusengine/agents/go-tooling-security"><img src="https://agentmods.dev/badge/skills/fusengine/agents/go-tooling-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01507 |
| Opus 5.5 | $0.00018 | $0.00603 |
| Sonnet 5.5 | $0.00009 | $0.00301 |
| Haiku 4.5 | $0.00005 | $0.00151 |
Grade A, and why
go-tooling-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Go Tooling & Security
Agent Workflow (MANDATORY)
Before ANY tooling/security change, spawn 3 agents in parallel, one Agent call each with a name:
- fuse-ai-pilot:explore-codebase - Find existing go.mod/go.work,
.golangci.yml, CI files - fuse-ai-pilot:research-expert - Verify latest golangci-lint v2 + govulncheck docs via Context7/Exa
- mcp__context7__query-docs - Check current Go 1.27
go fixmodernizer set
After changes, run fuse-ai-pilot:sniper for validation.
Overview
| Area | Description |
|---|---|
| Modules & Workspaces | go.mod directives, go.work for multi-module dev without replace |
| golangci-lint v2 | Config version "2", formatters section, golangci-lint migrate |
| govulncheck | Reachability-based scan of the call graph against vuln.go.dev |
| go fix modernizers | Suite of fixers (rebuilt in 1.26, extended in 1.27), //go:fix inline for API migrations |
| CI quality gate | fmt → vet → golangci-lint → govulncheck → test -race |
Critical Rules
- Never invent flags or directives - Confirm every
go/tool flag against official docs first - golangci-lint v2 config MUST start with
version: "2"- v1 configs are rejected; migrate, don't hand-edit - govulncheck runs in source mode by default - Reachability filters noise; only reported findings matter
go.workis usually not committed - Commit only when modules are developed exclusively together- CI gate order is fail-fast - Formatting/vet before linters before vulnerability scan before tests
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed · +1 lines b6ddefd2ed11
- 1mo ago Changed 8056c11d82f6
- 1mo ago First seen · 150 lines · 46 tokens per session scan A 98c30cd216fb
go-tooling-security is a skill published in the GitHub repository fusengine/agents (33 stars, last pushed 8d ago), licensed MIT. It adds 46 tokens to every session and 1,507 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
modal
Modal is a serverless cloud platform for running Python on demand, including on-demand GPUs. Use when deploying or serving AI/ML models, running GPU-accelerated workloads (training, fine-tuning, inference), serving web endpoints, scheduling batch jobs, or scaling Python code to cloud containers with the Modal SDK.
uptime-monitor
Monitor website uptime - check availability, response times, and status.
business-continuity-and-resilience
Plans for operating through disruption — impact analysis, recovery objectives, continuity plans, and the exercises that prove they work. Use this to run a business impact analysis, set RTO and RPO, write or test a continuity plan, prepare for a supplier or site failure, or answer a customer's resilience questionnaire.
craft-cloud
Craft Cloud — Pixel & Tonic's serverless hosting platform for Craft CMS. Covers craft-cloud.yaml configuration, the Build → Migrate → Release deploy pipeline, the craftcms/cloud extension package, edge image transforms via Cloudflare, edge static caching with cache.rules + ESI, Cloud-managed S3 filesystem, MySQL 8 /…
servd
Servd (servd.host) — Craft-specialised managed hosting for Craft CMS. Covers git push-to-deploy with the optional servd.yaml build config, local → staging → production environments with uni-directional Project Config sync, the servd/craft-asset-storage plugin (S3-backed Flysystem volumes on the svdcdn.com CDN…
Solana Squads Upgrade
This skill should be used when the user asks to "upgrade a Solana program through Squads", "set up squads multisig deployment", "create a Squads upgrade proposal", "configure squads-program-action", "deploy via Squads multisig", "set up Squads CI/CD pipeline", "squads GitHub Actions workflow", or mentions Solana…