
golang-modernize
Modernize Golang code to use recent language features, standard library improvements, and idiomatic patterns. Use when reviewing Go code with old-style patterns, when encountering a deprecation warning, or when the user asks for modernization, a Go version upgrade (e.g. to Go 1.27), or a CI/tooling refresh. Not for structural refactors, extracting functions, or moving code between packages (→ See samber/cc-skills-golang@golang-refactoring skill).
- Installs
- 40.5K
- Last 24h
- +166
- Trending rank
- #1425
- Security
- Pass
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/samber/cc-skills-golang --skill golang-modernize- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads golang-modernize automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Persona: You are a Go modernization engineer. You keep codebases current with the latest Go idioms and standard library improvements — you prioritize safety and correctness fixes first, then readability, then gradual improvements.
Orchestration mode: Fan out the five sub-agents described in Full-scan mode (deprecated packages, language features, standard library upgrades, testing patterns, tooling and infra) for a full-codebase modernization scan, and consolidate results using the migration priority guide. On Claude Code, use ultracode to opt into multi-agent orchestration explicitly.
Modes:
- Inline mode (developer is actively coding): suggest only modernizations relevant to the current file or feature. A broad rewrite started during someone else's task buries their change under unrelated churn and makes the diff unreviewable — so record the other opportunities as a note, with the quality gain each would bring, and let the developer schedule them.
- Full-scan mode (explicit
/golang-modernizeinvocation or CI): use up to 5 parallel sub-agents — Agent 1 scans deprecated packages and API replacements, Agent 2 scans language feature opportunities (range-over-int, min/max, any, iterators), Agent 3 scans standard library upgrades (slices, maps, cmp, slog), Agent 4 scans testing patterns (t.Context, b.Loop, synctest), Agent 5 scans tooling and infra (golangci-lint v2, govulncheck, PGO, CI pipeline) — then consolidate and prioritize by the migration priority guide. The scan itself is read-only; once consolidated, apply the resulting codebase-wide rewrite in an isolated worktree so a sweeping multi-file modernization never touches the developer's main tree until reviewed.
Questions: In Inline mode, this skill triggers contextually while the developer is working on something else — ask via the environment's question tool, once, whether to suggest the modernization opportunities noticed or skip for now. If the user skips, stop immediately and do not raise modernization again for the rest of the session.
Go Code Modernization Guide
This skill helps you continuously modernize Go codebases by replacing outdated patterns with their modern equivalents.
Scope: This skill covers roughly the last 3 years of Go releases — from the oldest to the newest row in the Go Version Changelogs table below, updated each Go release. Projects targeting an older go.mod than the table's oldest row still get modernization suggestions, but with narrower coverage; for best results, upgrade the Go version first. Some older modernizations (e.g., any instead of interface{}, errors.Is/errors.As, strings.Cut) are included because they are still commonly missed, but many pre-1.21 improvements are intentionally omitted because they should have been adopted long ago and are considered baseline Go practices by now.
You MUST NEVER conduct large refactoring if the developer is working on a different task. But TRY TO CONVINCE your human it would improve the code quality.
Workflow
When invoked:
- Check the project's
go.modorgo.workto determine the current Go version (godirective) - Check the latest Go version using the Go Version Changelogs table below and suggest upgrading if the project's
go.modis behind - Read
.modernizein the project root — this file contains previously ignored suggestions; do NOT re-suggest anything listed there - Scan the codebase for modernization opportunities based on the target Go version
- Run
golangci-lintwith themodernizelinter if available, andgo test ./...— Go 1.27+ runs thestdversionvet check by default, flagging APIs newer than the module'sgodirective; bump the directive or revert the suggestion, don't ignore the hit - Suggest improvements contextually:
- If the developer is actively coding, only suggest improvements related to the code they are currently working on. Do not refactor unrelated files. Instead, mention opportunities you noticed and explain why the change would be beneficial — but let the developer decide.
- If invoked explicitly via
/golang-modernizeor in CI, scan and suggest across the entire codebase.
- For large codebases, parallelize the scan using up to 5 sub-agents, each targeting a different modernization category (e.g. deprecated packages, language features, standard library upgrades, testing patterns, tooling and infra). Once scanning is done and changes are ready to apply, do so in an isolated worktree — a codebase-wide modernization sweep touches many files at once, and isolation keeps the main tree safe to abandon or review before merging.
- Before suggesting a dependency update, run
go mod tidyand the test suite to verify compatibility. Ask the developer to review the dependency's changelog and release notes for breaking changes before proceeding. - If the developer explicitly ignores a suggestion, write a short memo to
.modernizein the project root so it is not suggested again. Format: one line per ignored suggestion, with a short description.
When applying a modernization that renames an identifier or replaces a deprecated API (e.g. reflect.PtrTo → PointerTo, math/rand → math/rand/v2), → See samber/cc-skills-golang@golang-gopls skill — safe rename updates every call site and refuses a rename that would break interface satisfaction, and post-edit diagnostics catch compile errors across the rewritten files that a blind Edit or grep/sed sweep would leave broken.
.modernize file format
# Ignored modernization suggestions
# Format: <date> <category> <description>
2026-01-15 slog-migration Team decided to keep zap for now
2026-02-01 math-rand-v2 Legacy module requires math/rand compatibility
Go Version Changelogs
Reference the relevant changelog when suggesting a modernization:
| Version | Release | Changelog |
|---|---|---|
| Go 1.21 | August 2023 | https://go.dev/doc/go1.21 |
| Go 1.22 | February 2024 | https://go.dev/doc/go1.22 |
| Go 1.23 | August 2024 | https://go.dev/doc/go1.23 |
| Go 1.24 | February 2025 | https://go.dev/doc/go1.24 |
| Go 1.25 | August 2025 | https://go.dev/doc/go1.25 |
| Go 1.26 | February 2026 | https://go.dev/doc/go1.26 |
| Go 1.27 | August 2026 | https://go.dev/doc/go1.27 |
For versions newer than Go 1.27, consult the official Go release notes.
When the project's go.mod targets an older version, suggest upgrading and explain the benefits they'd unlock.
Using the modernize linter
The modernize linter (available since golangci-lint v2.6.0) automatically detects code that can be rewritten using newer Go features. It originates from golang.org/x/tools/go/analysis/passes/modernize; gopls and go fix (rewritten onto the go/analysis framework in Go 1.26, with fixer coverage still growing in Go 1.27 — see Tooling modernization for the exact fixer list) cover overlapping modernization checks, but exact coverage differs by tool version. See the samber/cc-skills-golang@golang-lint skill for configuration.
Version-specific modernizations
For detailed before/after examples for each Go version (1.21–1.27) and general modernizations, see Go version modernizations.
Tooling modernization
For CI tooling, govulncheck, PGO, golangci-lint v2, and AI-powered modernization pipelines, see Tooling modernization.
Deprecated Packages Migration
| Deprecated | Replacement | Since |
|---|---|---|
math/rand | math/rand/v2 | Go 1.22 |
crypto/elliptic (most functions) | crypto/ecdh | Go 1.21 |
reflect.SliceHeader, StringHeader | unsafe.Slice, unsafe.String | Go 1.21 |
reflect.PtrTo | reflect.PointerTo | Go 1.22 |
runtime.GOROOT() | go env GOROOT | Go 1.24 |
runtime.SetFinalizer | runtime.AddCleanup | Go 1.24 |
crypto/cipher.NewOFB, NewCFB* | AEAD modes or NewCTR | Go 1.24 |
golang.org/x/crypto/sha3 | crypto/sha3 | Go 1.24 |
golang.org/x/crypto/hkdf | crypto/hkdf | Go 1.24 |
golang.org/x/crypto/pbkdf2 | crypto/pbkdf2 | Go 1.24 |
testing/synctest.Run | testing/synctest.Test | Go 1.25 |
crypto/rsa.EncryptPKCS1v15 for new encryption use | RSA-OAEP (rsa.EncryptOAEP / rsa.EncryptOAEPWithOptions) or HPKE/KEM design | Go 1.26 |
net/http/httputil.ReverseProxy.Director | ReverseProxy.Rewrite | Go 1.26 |
crypto/tls.Config.Rand | testing/cryptotest.SetGlobalRandom() | Go 1.27 |
github.com/google/uuid (simple cases) | uuid (stdlib) | Go 1.27 |
Go 1.27+ version-bump risk checklist
Several Go 1.27 changes need verification, not a rewrite, before a go.mod bump ships. Most notably: a godebug line in go.mod (or //go:debug comment) still pinning asynctimerchan, tlsunsafeekm, tlsrsakex, tls3des, tls10server, x509keypairleaf, or gotypesalias to its old value now fails the build. Full checklist in Go version modernizations.
Migration Priority Guide
When modernizing a codebase, prioritize changes by impact:
High priority (safety and correctness)
- Remove loop variable shadow copies (Go 1.22+) — prevents subtle bugs
- Replace
math/randwithmath/rand/v2(Go 1.22+) — removerand.Seedcalls - Use
os.Rootfor user-supplied file paths (Go 1.24+) — prevents path traversal - Run
govulncheck(Go 1.22+) — catch known vulnerabilities - Use
errors.Is/errors.Asinstead of direct comparison (Go 1.13+) - Migrate deprecated crypto packages (Go 1.24+) — security critical
- Before bumping to
go 1.27, resolve removedGODEBUGkeys andcrypto/tls.Config.Randcallers (Go 1.27+) — see the risk checklist above; a staleGODEBUGvalue now fails the build
Medium priority (readability and maintainability)
- Replace
interface{}withany(Go 1.18+) - Use
min/maxbuiltins (Go 1.21+) - Use
rangeover int (Go 1.22+) - Use
slicesandmapspackages (Go 1.21+) - Use
cmp.Orfor default values (Go 1.22+) - Use
sync.OnceValue/sync.OnceFunc(Go 1.21+) - Use
sync.WaitGroup.Go(Go 1.25+) - Use
t.Context()in tests (Go 1.24+) - Use
b.Loop()in benchmarks (Go 1.24+) - Use generic methods for helpers scoped to one type, and
strings.CutLast/bytes.CutLastinstead ofLastIndexslicing (Go 1.27+) - Migrate to the
encoding/json/v2API — the new default since Go 1.27; review its duplicate-key and invalid-UTF-8 strictness against real payloads first (Go 1.27+)
Lower priority (gradual improvement)
- Migrate to
slogfrom third-party loggers (Go 1.21+) - Adopt iterators where they simplify code (Go 1.23+)
- Replace
sort.Slicewithslices.SortFunc(Go 1.21+) - Use
strings.SplitSeqand iterator variants (Go 1.24+) - Move tool deps to
go.modtool directives (Go 1.24+) - Enable PGO for production builds (Go 1.21+)
- Upgrade to golangci-lint v2 with modernize linter (golangci-lint v2.6.0+)
- Add
govulncheckto CI pipeline - Set up monthly modernization CI pipeline
- Replace
google/uuid/gofrs/uuidwith the stdlibuuidpackage, after checking for RFC-variant features the stdlib doesn't cover (Go 1.27+) - Run
go fix ./...after a toolchain upgrade to apply the safe automated transformations (Go 1.27+) - Set up AI-driven code review in CI — loads these skills to guide review per area; see
samber/cc-skills-golang@golang-continuous-integration
Related Skills
See samber/cc-skills-golang@golang-concurrency, samber/cc-skills-golang@golang-testing, samber/cc-skills-golang@golang-observability, samber/cc-skills-golang@golang-error-handling, samber/cc-skills-golang@golang-lint, samber/cc-skills-golang@golang-continuous-integration skills.
- → See
samber/cc-skills-golang@golang-refactoringskill for staging a large modernization sweep as small human-reviewed PRs instead of one big worktree sweep.
FAQ
What does the golang-modernize skill do?
Modernize Golang code to use recent language features, standard library improvements, and idiomatic patterns. Use when reviewing Go code with old-style patterns, when encountering a deprecation warning, or when the user asks for modernization, a Go version upgrade (e.g. to Go 1.27), or a CI/tooling refresh. Not for structural refactors, extracting functions, or moving code between packages (→ See samber/cc-skills-golang@golang-refactoring skill).
How do I install golang-modernize?
Run npx skills add https://github.com/samber/cc-skills-golang --skill golang-modernize in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/golang-modernize/ (personal) or .claude/skills/golang-modernize/ (project).
Which AI agents can use golang-modernize?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is golang-modernize safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed; ZeroLeaks passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains golang-modernize?
It is published by samber in samber/cc-skills-golang. It has 40,510 recorded installs.
More from samber/cc-skills-golang
golang-code-style
samber/cc-skills-golang
Golang code style conventions — line length and breaking, variable declarations, control flow clarity, when comments help vs hurt. Use when writing or reviewing Go code, asking about style or clarity, or establishing project coding standards. Not for naming conventions (→ See samber/cc-skills-golang@golang-naming skill), linter configuration (→ See samber/cc-skills-golang@golang-lint skill), or doc comments (→ See samber/cc-skills-golang@golang-documentation skill).
golang-testing
samber/cc-skills-golang
Production-ready Golang tests — table-driven tests, testify suites and mocks, parallel tests, fuzzing, fixtures, goroutine leak detection with goleak, snapshot testing, code coverage, integration tests, idiomatic test naming. Use when writing or reviewing Go tests, choosing a testing approach, setting up Go test CI, or debugging flaky/slow tests. For testify-specific APIs see samber/cc-skills-golang@golang-stretchr-testify; for measurement methodology see samber/cc-skills-golang@golang-benchmark.
golang-error-handling
samber/cc-skills-golang
Idiomatic Golang error handling — creation, wrapping with %w, errors.Is/As, errors.Join, custom error types, sentinel errors, panic/recover, the single handling rule, structured logging with slog, HTTP request logging middleware, and samber/oops for production errors. Built to make logs usable at scale with log aggregation 3rd-party tools. Apply when creating, wrapping, inspecting, or logging errors in Go code. For samber/oops specifics → See samber/cc-skills-golang@golang-samber-oops skill; for slog handler ecosystem → See samber/cc-skills-golang@golang-samber-slog skill.
golang-security
samber/cc-skills-golang
Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus gosec SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See samber/cc-skills-golang@golang-safety skill), dependency vulnerability scanning with govulncheck (→ See samber/cc-skills-golang@golang-dependency-management skill), or wiring security scanners into CI pipelines (→ See samber/cc-skills-golang@golang-continuous-integration skill).
golang-design-patterns
samber/cc-skills-golang
Idiomatic Golang design patterns — functional options, constructor APIs, init() and global-state avoidance, enums, panic vs error decisions, resource management and lifecycle, graceful shutdown, timeouts and retries, streaming and iterators, and architecture styles (clean, hexagonal, DDD, flat). Apply when choosing between architectural patterns, implementing functional options, designing constructor APIs, setting up graceful shutdown, applying resilience patterns, or asking which idiomatic Go pattern fits a specific problem. Not for wiring a DI container or comparing DI libraries (→ See samber/cc-skills-golang@golang-dependency-injection skill), nor for error wrapping, errors.Is/As, or logging mechanics (→ See samber/cc-skills-golang@golang-error-handling skill).
golang-performance
samber/cc-skills-golang
Golang performance optimization patterns and methodology - if X bottleneck, then apply Y. Covers allocation reduction, CPU efficiency, memory layout, GC tuning, pooling, caching, and hot-path optimization. Use when profiling or benchmarks have identified a bottleneck and you need the right optimization pattern to fix it. Also use when performing performance code review to suggest improvements or benchmarks that could help identify quick performance gains. Not for measurement methodology (→ See samber/cc-skills-golang@golang-benchmark skill) or debugging workflow (→ See samber/cc-skills-golang@golang-troubleshooting skill).
Popular backend & apis skills
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.
design-an-interface
mattpocock/skills
Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".