Golang Dependency Management

This is a comprehensive dependency management guide that walks you through go.mod workflows, semantic versioning, and MVS quirks. It enforces a critical rule: AI agents must ask before adding dependencies, checking if the standard library already solves the problem. You get practical commands for upgrading (prefer go get -u=patch for safety), vendoring strategies, the tools.go pattern for pinning CLI versions, and references for vulnerability scanning with govulncheck. The skill pushes back against dependency bloat by treating every package as a long term maintenance commitment. Useful when adding libraries, resolving version conflicts, setting up Dependabot, or auditing what's inflating your binary size.

skills.sh installs: 41.4K
GitHub stars: 3.8K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add samber/cc-skills-golang --skill golang-dependency-management --agent claude-code

Installs into .claude/skills of the current project.

Files

Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.

Dependencies:

govulncheck: go install golang.org/x/vuln/cmd/govulncheck@latest

Go Dependency Management

AI Agent Rule: Ask Before Adding Dependencies

Before running go get to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using go get -u to upgrade an existing dependency is safe.

Before proposing a dependency, evaluate: