About code-security
A security skill for writing and reviewing application code and infrastructure configuration, covering common vulnerability classes with CWE/OWASP labels and remediation guidance. It is for engineers who want security checks integrated into coding or code review.
Key features
- 01Check injection, XSS, authentication, and SSRF
- 02Review secrets, sessions, and transport security
- 03Assess Terraform, Kubernetes, and related configuration
- 04Map findings to CWE/OWASP
- 05Suggest secure alternatives and fixes
Use cases
- 01Review code handling user input or external requests
- 02Inspect authentication, secrets, and session logic
- 03Review container and cloud infrastructure configuration
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/code-securityin Claude Code to confirm it loaded.
Bundled files
References and scripts installed along with SKILL.md.
references/code_security_scope_and_workflow.mdcrypto_auth_and_session.mddeserialization_ssrf_xxe.mdinfrastructure_as_code_security.mdinjection_and_input_validation.mdreview_checklist_and_owasp_mapping.mdDetails
From the project READMECode Security
When to Use
- Write or review application code for common vulnerability classes (injection, XSS, auth, crypto, SSRF, XXE, deserialization)
- Review secrets handling, session/JWT patterns, and transport security in code
- Review Terraform, Kubernetes manifests, Dockerfiles, or GitHub Actions for security misconfigurations
- Proactively harden code that accepts user input, performs I/O, queries databases, or calls external URLs
- Map findings to CWE/OWASP categories and suggest concrete secure patterns
When NOT to Use
- Plan or execute authorized penetration tests, exploit chains, or red-team campaigns →
ai-redteam,cybersecurity,penetration-tester,red-team-specialist - Map controls to SOC 2, ISO 27001, or build audit evidence packages →
compliance-engineer,compliance-specialist - Deploy SIEM, IdP, KMS, WAF, or operate security tooling →
information-security-engineer - Configure CI/CD scanners, SBOM, OIDC, or pipeline gates without secure-coding review →
devsecops - Author YARA or malware detection rules →
yara-rule-authoring - General feature design, RFCs, or refactoring without a security lens →
senior-software-engineer
Related skills
| Need | Skill |
|---|---|
| Security program strategy, policies, IR | cybersecurity |
| Control implementation, IdP, KMS, SIEM | information-security-engineer |
| CI/CD security gates, SBOM, pipeline OIDC | devsecops |
| Audit evidence and framework mapping | compliance-engineer |
| LLM/agent red team and prompt injection | ai-redteam |
| Code review, RFCs, reliability (non-security) | senior-software-engineer |
| Cloud account guardrails and CSPM | cloud-security-engineer |
| Cryptographic primitive/protocol design | cryptographer-specialist |
| Pentest findings reproduction | penetration-tester, web-pentester |
How to work
Modes
- Proactive — When writing or touching security-sensitive code (input, auth, files, DB, HTTP clients, crypto, IaC), check relevant categories without waiting for an explicit security ask.
- Reactive — When the user requests a security review, follow the review workflow in
references/review_checklist_and_owasp_mapping.md.
Workflow
- Identify language/stack and what the code does (input? DB? shell? XML? outbound HTTP? secrets? IaC?).
- Load the matching reference(s) below; prioritize Critical then High impact.
- Flag vulnerable patterns with CWE/OWASP labels; propose secure alternatives from references (language-specific examples live there).
- For reviews, produce severity-ordered findings with file/line context and fix guidance.
Language priority (first checks)
| Language / stack | Priority topics |
|---|---|
| Python | SQL/command injection, path traversal, code injection, SSRF, insecure crypto, deserialization |
| JavaScript/TypeScript | XSS, prototype pollution, code injection, CSRF, insecure transport |
| Java | SQL injection, XXE, insecure deserialization, SSRF, insecure crypto |
| Go | SQL/command injection, path traversal, SSRF, insecure transport |
| C/C++ | Memory safety, unsafe functions, command injection, path traversal |
| Ruby / PHP | SQL/command injection, XSS, deserialization (Ruby), code injection |
| HCL / YAML | Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions |
When to load references
Detailed vulnerable/secure patterns and multi-language examples are in references/ (condensed from 28 upstream rule categories). Do not expect per-language copies of every rule in SKILL.md.
| Topic | Reference |
|---|---|
| Scope, modes, language priorities | references/code_security_scope_and_workflow.md |
| SQL, command, XSS, path traversal, code injection | references/injection_and_input_validation.md |
| Secrets, JWT, CSRF, crypto, TLS | references/crypto_auth_and_session.md |
| XXE, deserialization, SSRF | references/deserialization_ssrf_xxe.md |
| Terraform, K8s, Docker, GitHub Actions | references/infrastructure_as_code_security.md |
| Review checklist, CWE/OWASP map, medium/low | references/review_checklist_and_owasp_mapping.md |
Quick prevention reference
| Vulnerability | Key prevention |
|---|---|
| SQL injection | Parameterized queries / prepared statements |
| XSS | Context-aware output encoding; CSP where appropriate |
| Command injection | Avoid shell; use APIs with argument lists |
| Path traversal | Canonicalize paths; allowlist base directories |
| SSRF | URL allowlists; block metadata/link-local ranges |
| Secrets | Env vars / secret managers; never commit credentials |
| Weak crypto | SHA-256+, AES-256-GCM; avoid MD5/SHA1/DES/ECB |
| XXE | Disable DTD/external entities in XML parsers |
| Deserialization | Do not deserialize untrusted data |
Comments
Markdown supported