skilld
All skills
semgrep avatar

/code-security

@327da93 official
by semgrepsemgrep/skills317 stars
31

Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'.

Ask your Agent

Use this Skill: https://skilld.dev/gh/semgrep/skills/code-security

This session only. Nothing lands on disk.

rules_sections.md

≈1.8k tokens on demand. Your agent reads this file only when SKILL.md points to it.

Sections

This file defines all sections, their ordering, impact levels, and descriptions. The section ID (in parentheses) is the filename prefix used to group rules.

Critical Impact

1. SQL Injection (sql-injection)

Impact: CRITICAL Description: SQL injection allows attackers to manipulate database queries, leading to data theft, modification, or deletion. OWASP Top 10.

2. Command Injection (command-injection)

Impact: CRITICAL Description: OS command injection allows attackers to execute arbitrary system commands, leading to full system compromise. CWE-78.

3. Cross-Site Scripting (xss)

Impact: CRITICAL Description: XSS allows attackers to inject malicious scripts into web pages, leading to session hijacking, defacement, or malware distribution. CWE-79.

4. XML External Entity (xxe)

Impact: CRITICAL Description: XXE attacks exploit XML parsers to access local files, perform SSRF, or cause denial of service. CWE-611.

5. Path Traversal (path-traversal)

Impact: CRITICAL Description: Path traversal allows attackers to access files outside intended directories using sequences like "../". CWE-22.

6. Insecure Deserialization (insecure-deserialization)

Impact: CRITICAL Description: Deserializing untrusted data can lead to remote code execution, DoS, or authentication bypass. CWE-502.

7. Code Injection (code-injection)

Impact: CRITICAL Description: Code injection (eval, template injection) allows attackers to execute arbitrary code in the application context. CWE-94.

8. Hardcoded Secrets (secrets)

Impact: CRITICAL Description: Hardcoded credentials, API keys, and tokens in source code lead to unauthorized access when code is exposed. CWE-798.

9. Memory Safety (memory-safety)

Impact: CRITICAL Description: Memory safety issues (buffer overflow, use-after-free) can lead to code execution or crashes. CWE-119, CWE-416.

High Impact

10. Insecure Cryptography (insecure-crypto)

Impact: HIGH Description: Weak hashing (MD5, SHA1), weak encryption (DES, RC4), or improper key management compromises data confidentiality. CWE-327.

11. Insecure Transport (insecure-transport)

Impact: HIGH Description: Cleartext transmission, disabled certificate verification, or weak TLS exposes data in transit. CWE-319.

12. Server-Side Request Forgery (ssrf)

Impact: HIGH Description: SSRF allows attackers to make requests from the server to internal systems or cloud metadata endpoints. CWE-918.

13. JWT Authentication (authentication-jwt)

Impact: HIGH Description: JWT vulnerabilities include the "none" algorithm attack, weak secrets, and missing signature verification. CWE-347.

14. Cross-Site Request Forgery (csrf)

Impact: HIGH Description: CSRF attacks force authenticated users to perform unwanted actions without their knowledge. CWE-352.

15. Prototype Pollution (prototype-pollution)

Impact: HIGH Description: Prototype pollution in JavaScript can lead to property injection, denial of service, or code execution. CWE-1321.

16. Unsafe Functions (unsafe-functions)

Impact: HIGH Description: Inherently dangerous functions (gets, strcpy, eval) bypass safety checks and should be avoided. CWE-242.

17. Terraform AWS Security (terraform-aws)

Impact: HIGH Description: AWS infrastructure misconfigurations including public S3 buckets, unencrypted resources, and overly permissive IAM.

18. Terraform Azure Security (terraform-azure)

Impact: HIGH Description: Azure infrastructure misconfigurations including public endpoints, missing encryption, and insecure network settings.

19. Terraform GCP Security (terraform-gcp)

Impact: HIGH Description: GCP infrastructure misconfigurations including public resources, disabled logging, and insecure IAM bindings.

20. Kubernetes Security (kubernetes)

Impact: HIGH Description: Kubernetes misconfigurations including privileged containers, host namespace access, and excessive RBAC permissions.

21. Docker Security (docker)

Impact: HIGH Description: Docker misconfigurations including running as root, privileged mode, and exposed Docker socket.

22. GitHub Actions Security (github-actions)

Impact: HIGH Description: GitHub Actions vulnerabilities including script injection, unsafe checkout of PR code, and unpinned actions.

Medium Impact

23. Regular Expression DoS (regex-dos)

Impact: MEDIUM Description: ReDoS attacks exploit inefficient regex patterns to cause CPU exhaustion and denial of service. CWE-1333.

24. Race Conditions (race-condition)

Impact: MEDIUM Description: TOCTOU race conditions and insecure temporary file creation can lead to privilege escalation. CWE-367.

25. Code Correctness (correctness)

Impact: MEDIUM Description: Common coding mistakes including exception handling errors, null checks, type errors, and logic bugs.

Low Impact

26. Best Practices (best-practice)

Impact: LOW Description: Code style, API usage patterns, deprecated patterns, and general coding recommendations.

27. Performance (performance)

Impact: LOW Description: Performance anti-patterns including inefficient loops, unnecessary database queries, and memory waste.

28. Maintainability (maintainability)

Impact: LOW Description: Code organization, deprecated API usage, naming conventions, and long-term code health.

Rule File Summary

# Category Filename Impact
1 SQL Injection sql-injection.md CRITICAL
2 Command Injection command-injection.md CRITICAL
3 Cross-Site Scripting xss.md CRITICAL
4 XML External Entity xxe.md CRITICAL
5 Path Traversal path-traversal.md CRITICAL
6 Insecure Deserialization insecure-deserialization.md CRITICAL
7 Code Injection code-injection.md CRITICAL
8 Hardcoded Secrets secrets.md CRITICAL
9 Memory Safety memory-safety.md CRITICAL
10 Insecure Cryptography insecure-crypto.md HIGH
11 Insecure Transport insecure-transport.md HIGH
12 SSRF ssrf.md HIGH
13 JWT Authentication authentication-jwt.md HIGH
14 CSRF csrf.md HIGH
15 Prototype Pollution prototype-pollution.md HIGH
16 Unsafe Functions unsafe-functions.md HIGH
17 Terraform AWS terraform-aws.md HIGH
18 Terraform Azure terraform-azure.md HIGH
19 Terraform GCP terraform-gcp.md HIGH
20 Kubernetes kubernetes.md HIGH
21 Docker docker.md HIGH
22 GitHub Actions github-actions.md HIGH
23 Regex DoS regex-dos.md MEDIUM
24 Race Conditions race-condition.md MEDIUM
25 Correctness correctness.md MEDIUM
26 Best Practices best-practice.md LOW
27 Performance performance.md LOW
28 Maintainability maintainability.md LOW

Source: SKILL.md on GitHub

Third-party checks

2 warnings16d5 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill provides a comprehensive library of security guidelines and code examples to help AI agents write secure code and perform security reviews. It covers OWASP Top 10 vulnerabilities, infrastructure security (Terraform, Kubernetes, Docker), and general best practices. While the files contain examples of vulnerable code (such as SQL injection and hardcoded secrets), these are used exclusively for educational purposes to demonstrate what to avoid and are part of the 'Incorrect' examples within the security rules.

  • Socket16d

    2 alerts: gptSecurity

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    4/34 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 327da93. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 7 months ago

Topics

  • Security
  • Infrastructure
  • code-review
  • owasp
  • sql-injection
  • xss
  • command-injection
  • authentication
  • terraform
  • kubernetes
  • docker

README badge

README badge for semgrep/skills/code-security

What it does

Provides security rules across 15+ languages covering OWASP Top 10 vulnerabilities, infrastructure configuration, and secure coding practices. Includes SQL injection, XSS, command injection, cryptography, and Kubernetes/Terraform security with language-specific priority guidelines and rule files for detailed code examples.

Generated from the current SKILL.md.

Frequently asked

Does this skill cover infrastructure security like Terraform and Kubernetes?
Yes. The skill includes 28 rule categories covering Terraform (AWS, Azure, GCP), Kubernetes, Docker, and GitHub Actions alongside language-specific rules for Python, JavaScript, Java, Go, C/C++, Ruby, and PHP.
When should I use this skill — only when the user asks about security?
No. The skill is designed for proactive mode: automatically check for vulnerabilities when writing or reviewing any code that handles user input, authentication, databases, file operations, network requests, cryptography, or infrastructure configuration — even if the user doesn't explicitly mention security.
What vulnerabilities does this skill prioritize?
It prioritizes Critical impact rules first: SQL injection, command injection, XSS, XXE, path traversal, insecure deserialization, code injection, hardcoded secrets, and memory safety. High impact rules include insecure crypto, SSRF, JWT issues, and CSRF.
Does this skill provide code examples for each vulnerability type?
Yes. Each rule category (e.g., `rules/sql-injection.md`) contains detailed vulnerable and secure code examples in the relevant language.

Generated from the current SKILL.md. These answers refresh after source changes.