Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/johnqtcg/awesome-skillsnpx agentmods add skills/johnqtcg/awesome-skills/go-makefile-writerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/johnqtcg/awesome-skills/go-makefile-writer)<a href="https://agentmods.dev/skills/johnqtcg/awesome-skills/go-makefile-writer"><img src="https://agentmods.dev/badge/skills/johnqtcg/awesome-skills/go-makefile-writer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/johnqtcg/awesome-skills/go-makefile-writer"><img src="https://agentmods.dev/badge/skills/johnqtcg/awesome-skills/go-makefile-writer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.06561 |
| Opus 5 | $0.00023 | $0.03281 |
| Sonnet 5 | $0.00009 | $0.01312 |
| Haiku 4.5 | $0.00005 | $0.00656 |
Grade C, and why
go-makefile-writer scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- **[C] A pipeline reports only its last command's status.** `curl … | sh` succeeds Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **[C] A pipeline reports only its last command's status.** `curl … | sh` succeeds How it starts
The opening of the file, as written. The whole thing — 354 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Go Makefile Writer
Design a practical root Makefile that is readable, reproducible, and aligned with repository layout.
Quick Reference
| If you need to… | Go to |
|---|---|
| Create a Makefile from scratch for a new Go project | §Execution Modes → Create + §Workflow |
| Refactor or update an existing Makefile (minimal-diff) | §Execution Modes → Refactor |
Decide which targets to include (build, test, lint, ci…) |
§Workflow (Plan targets) |
| Get a complete working Makefile example to start from | Load references/golden/simple-project.mk or complex-project.mk |
Check quality rules, variable conventions, .PHONY requirements |
Load references/makefile-quality-guide.md |
| Review a Makefile PR quickly | Load references/pr-checklist.md |
| Handle a monorepo or multi-module Go repo | §Monorepo Support |
Execution Modes
Select a mode before starting and state it in the output report.
Create (new Makefile from scratch)
- Full target set generated from project inspection.
- Use golden templates (simple-project.mk / complex-project.mk) as starting points.
- No backward-compatibility concerns.
Refactor (modify existing Makefile)
- Minimal-diff edits — change only what is needed; do not rewrite the entire file.
- Backward compatibility: if target names change, keep aliases for at least one transition period and document them in the output report.
- Preserve existing useful targets unless user explicitly asks to remove them.
- Before editing, snapshot the current target list via
make -qp | awk -F: '/^[a-zA-Z0-9_-]+:/ {print $1}' | sort -ufor comparison. - Validation must include verifying that previously used critical targets still work (or their aliases do).
Workflow
-
Select mode (
CreateorRefactor) and record rationale. -
Inspect project structure:
- discover entrypoints (
package main, wherever it lives) by running this skill's discovery script against the target repo:bash <skill-dir>/scripts/discover_go_entrypoints.sh <project-root>(the script lives in the skill directory, not in the target repo — pass the repo root as its argument) - read the script's exit status before its output.
0means the query was complete and what you got is the whole answer — including an empty answer, which then genuinely means "library, no programs".4means the query was incomplete: empty output is unknown, not library.2is a bad root,3(with--modules) is zero modules. The stderr diagnostic names the toolchain error to fix - the script emits 5 tab-separated fields —
kind name target_name dir confidence.confidenceis not decoration.confirmedmeansgo listreported the package's name asmain, and can become a build target directly.candidatemeans the toolchain could not be asked about that subtree and the row is a filename guess — list those to the user for confirmation instead of generating targets from them, and say in your output that they are unconfirmed - if the script cannot run at all, fall back to
find cmd -name main.go -type f, but treat every result as a candidate: a file namedmain.gomay declare any package, and a program's file may be named anything - detect quality tools and conventions (
go test,golangci-lint,swag) - detect code generation usage (
go generate, protobuf, wire, mockgen, etc.) - detect containerization (
Dockerfile,docker-compose.yml) - read
go.modfor Go version (godirective) and module path - inspect existing
Makefileif present (Refactor mode) - detect workspace / multi-module layout via the toolchain first:
go env GOWORK— a real path means ago.workworkspace (its modules arego list -m), while the literal stringoffmeans workspace mode was disabled and must be treated as "no workspace", not as a path. Only when there is nogo.workfall back to a scopedgo.modsearch (bash <skill-dir>/scripts/discover_go_entrypoints.sh --modules <project-root>, which excludesvendor/,testdata/,examples/). See §Monorepo Support.
- discover entrypoints (
What ships with it
27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/golden/complex-project.mk 9.3 KB
- references/golden/simple-project.mk 4.7 KB
- references/makefile-quality-guide.md 15 KB
- references/pr-checklist.md 6.1 KB
- scripts/discover_go_entrypoints.sh 16 KB runs code
- scripts/run_regression.sh 905 B runs code
- scripts/tests/COVERAGE.md 11 KB
- scripts/tests/golden/001_missing_help.json 411 B
- scripts/tests/golden/002_missing_race.json 592 B
- scripts/tests/golden/003_missing_ldflags.json 417 B
- scripts/tests/golden/004_no_phony.json 364 B
- scripts/tests/golden/005_cross_compile_with_cgo.json 661 B
- scripts/tests/golden/006_target_name_mismatch.json 424 B
- scripts/tests/golden/007_unpinned_tools.json 434 B
- scripts/tests/golden/008_good_makefile.json 1.0 KB
- scripts/tests/golden/009_custom_help_format_fp.json 596 B
- scripts/tests/golden/010_gofmt_variant_fp.json 518 B
- scripts/tests/golden/011_no_docker_targets_fp.json 605 B
- scripts/tests/golden/012_ci_target_diverges.json 631 B
- scripts/tests/golden/013_refactor_rename_no_alias.json 766 B
- scripts/tests/golden/014_monorepo_missing_aggregates.json 842 B
- scripts/tests/golden/015_tab_vs_space_recipes.json 716 B
- scripts/tests/golden/016_missing_tidy_target.json 567 B
- scripts/tests/test_executable_assets.py 34 KB runs code
- scripts/tests/test_golden_reviews.py 9.9 KB runs code
- scripts/tests/test_shipped_recipes.py 43 KB runs code
- scripts/tests/test_skill_contract.py 16 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +89 lines scan A → C 63f6ebc11da8
- 12d ago First seen · 265 lines · 47 tokens per session scan A 49326aa4c525
go-makefile-writer is a skill published in the GitHub repository johnqtcg/awesome-skills (30 stars, last pushed yesterday), licensed MIT. It adds 47 tokens to every session and 6,561 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golang-testing
Go testing best practices including table-driven tests, test helpers, benchmarking, race detection, coverage analysis, and integration testing patterns. Use when writing or improving Go tests.
golang-patterns
Go-specific design patterns and best practices including functional options, small interfaces, dependency injection, concurrency patterns, error handling, and package organization. Use when working with Go code to apply idiomatic Go patterns.
security-compliance
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
stride-analysis-patterns
Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
cache-components
Expert guidance for Next.js Cache Components and Partial Prerendering (PPR). PROACTIVE ACTIVATION: Use this skill automatically when working in Next.js projects that have cacheComponents: true in their next.config.ts/next.config.js. When this config is detected, proactively apply Cache Components patterns and best…
manage-skills
A maintenance workflow for checking whether project verification skills still cover the code and rules that changed during a session.