skilld
All skills
semgrep avatar

/code-security

@327da93 official
by semgrepsemgrep/skills316 stars
31

Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'.

Ask your Agent

Use this Skill: https://skilld.dev/gh/semgrep/skills/code-security

This session only. Nothing lands on disk.

README.md

≈686 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Code Security Skill

Comprehensive security guidelines for writing secure code across 15+ languages, covering OWASP Top 10, infrastructure security, and coding best practices.

Categories (28 Total)

Critical Impact

  • SQL Injection, Command Injection, XSS, XXE, Path Traversal
  • Insecure Deserialization, Code Injection, Hardcoded Secrets, Memory Safety

High Impact

  • Insecure Crypto, Insecure Transport, SSRF, JWT Auth, CSRF
  • Prototype Pollution, Unsafe Functions
  • Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions

Medium/Low Impact

  • Regex DoS, Race Conditions, Code Correctness
  • Best Practices, Performance, Maintainability

Structure

code-security/
├── SKILL.md           # Skill definition (loaded by agents)
├── rules/             # Security rule files
│   ├── _sections.md   # Index of all categories
│   ├── _template.md   # Template for new rules
│   ├── sql-injection.md
│   ├── xss.md
│   └── ...            # 28 rule files total
├── metadata.json      # Skill metadata
└── README.md          # This file

Usage

For End Users

Install the skill:

npx skills add semgrep/skills

The agent will automatically reference these guidelines when writing or reviewing code.

For Contributors

From the repo root:

make validate    # Validate all rule files
make build       # Build the skill
make zip         # Create distribution package
make             # All of the above

Or from the build package:

cd packages/skill-build
pnpm install
pnpm validate code-security    # Validate rule files
pnpm build-agents code-security  # Build AGENTS.md

Creating a New Rule

  1. Copy rules/_template.md to rules/{category}.md
  2. Follow this structure:
---
title: Rule Title
impact: HIGH
tags: security, category-name
---

## Rule Title

Brief explanation of the vulnerability.

**Incorrect (description):**

```python
# Vulnerable code
```

**Correct (description):**

```python
# Secure code
```
  1. Run make validate to check formatting
  2. Run make to rebuild everything

Impact Levels

Level Description
CRITICAL Remote code execution, data breach
HIGH Significant security risk
MEDIUM Moderate risk, defense in depth
LOW Best practices, code quality

Languages Supported

Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, C/C++, C#, Scala, Kotlin, Rust, HCL (Terraform), YAML (Kubernetes/Docker)

Acknowledgments

Created by @DrewDennison at Semgrep.

Rules derived from Semgrep Registry with 2000+ security patterns.

Source: SKILL.md on GitHub

Third-party checks

2 warnings16d5 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill provides a comprehensive library of security guidelines and code examples to help AI agents write secure code and perform security reviews. It covers OWASP Top 10 vulnerabilities, infrastructure security (Terraform, Kubernetes, Docker), and general best practices. While the files contain examples of vulnerable code (such as SQL injection and hardcoded secrets), these are used exclusively for educational purposes to demonstrate what to avoid and are part of the 'Incorrect' examples within the security rules.

  • Socket16d

    2 alerts: gptSecurity

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    4/34 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 327da93. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 7 months ago

Topics

  • Security
  • Infrastructure
  • code-review
  • owasp
  • sql-injection
  • xss
  • command-injection
  • authentication
  • terraform
  • kubernetes
  • docker

README badge

README badge for semgrep/skills/code-security

What it does

Provides security rules across 15+ languages covering OWASP Top 10 vulnerabilities, infrastructure configuration, and secure coding practices. Includes SQL injection, XSS, command injection, cryptography, and Kubernetes/Terraform security with language-specific priority guidelines and rule files for detailed code examples.

Generated from the current SKILL.md.

Frequently asked

Does this skill cover infrastructure security like Terraform and Kubernetes?
Yes. The skill includes 28 rule categories covering Terraform (AWS, Azure, GCP), Kubernetes, Docker, and GitHub Actions alongside language-specific rules for Python, JavaScript, Java, Go, C/C++, Ruby, and PHP.
When should I use this skill — only when the user asks about security?
No. The skill is designed for proactive mode: automatically check for vulnerabilities when writing or reviewing any code that handles user input, authentication, databases, file operations, network requests, cryptography, or infrastructure configuration — even if the user doesn't explicitly mention security.
What vulnerabilities does this skill prioritize?
It prioritizes Critical impact rules first: SQL injection, command injection, XSS, XXE, path traversal, insecure deserialization, code injection, hardcoded secrets, and memory safety. High impact rules include insecure crypto, SSRF, JWT issues, and CSRF.
Does this skill provide code examples for each vulnerability type?
Yes. Each rule category (e.g., `rules/sql-injection.md`) contains detailed vulnerable and secure code examples in the relevant language.

Generated from the current SKILL.md. These answers refresh after source changes.