Go Review

Go Review is SpecterOps' Claude Code plugin for security reviews of Go code: libraries, frameworks, CLIs, HTTP and gRPC services, and backend applications. Its skill builds an inventory of the code with Go's own parser, picks the review areas that apply, hands each one to a worker, then runs judges that merge duplicates and weed out false positives before it writes a report. What it reviews - Authentication and authorization boundaries - Request parsing and body limits - Outbound HTTP and SSRF - SQL and storage access, and command execution - Template rendering and XSS - Filesystem access and archive extraction - JWT, TLS, cookie and session handling - Goroutines, timeouts, cancellation and shared state - unsafe and cgo boundaries How you use it Run /go-review:go-review. It asks for a threat model (remote, local unprivileged or both), a severity filter (all, medium or high) and, if you like, a folder to limit the review to. Findings go to .go-review-results/<timestamp>/ in your project, with a REPORT.md and a REPORT.sarif. How to install it In Claude Code, run /plugin marketplace add SpecterOps/skills, then /plugin install go-review@specterops-skills. SpecterOps also supports it in Codex. Good to know - It needs Go 1.22 or newer and Python 3.11 or newer. It uses your installed Go toolchain and doesn't download tools or fetch your modules. - Its inventory reads Go syntax rather than types, so a finding is reported only after its data flow is checked for reachability. - The results folder can hold source excerpts, unconfirmed findings and local paths, so review it before you commit or share it. - Its workers use the model you're already using.