software-security

软件安全技能（Project CodeGuard）

此技能提供全面的安全指南，帮助 AI 编码 Agent 生成安全代码并防范常见漏洞。它基于 Project CodeGuard，这是一个开源、与模型无关的安全框架，可将默认安全实践融入 AI 编码工作流。

何时使用此技能

在以下情况下应启用此技能：

• 使用任何语言编写新代码
• 审查或修改现有代码
• 实现涉及安全的功能（身份验证、加密、数据处理等）
• 处理用户输入、数据库、API 或外部服务
• 配置云基础设施、CI/CD 管道或容器
• 处理敏感数据、凭据或加密操作

如何使用此技能

编写或审查代码时：

1. 始终应用的规则：每次代码操作都必须检查以下规则：

• codeguard-1-hardcoded-credentials.md - 切勿硬编码密钥、密码、API 密钥或令牌
• codeguard-1-crypto-algorithms.md - 仅使用现代、安全的加密算法
• codeguard-1-digital-certificates.md - 安全地验证和管理数字证书

2. 基于标签的规则：当你在代码中识别出以下任一安全场景时，应用所有带有匹配标签的规则：

安全场景（标签）	要应用的规则文件
authentication	codeguard-0-authentication-mfa.md, codeguard-0-session-management-and-cookies.md
data-security	codeguard-0-additional-cryptography.md, codeguard-0-data-storage.md
infrastructure	codeguard-0-cloud-orchestration-kubernetes.md, codeguard-0-data-storage.md, codeguard-0-devops-ci-cd-containers.md, codeguard-0-iac-security.md
privacy	codeguard-0-logging.md, codeguard-0-privacy-data-protection.md
secrets	codeguard-0-additional-cryptography.md, codeguard-1-digital-certificates.md, codeguard-1-hardcoded-credentials.md
web	codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-client-side-web-security.md, codeguard-0-input-validation-injection.md, codeguard-0-session-management-and-cookies.md

3. 特定语言的规则：根据正在实现的功能所使用的编程语言，按照下表应用 /rules 目录中的规则： | 语言 | 要应用的规则文件 | |----------|---------------------| | apex | codeguard-0-input-validation-injection.md | | c | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-client-side-web-security.md, codeguard-0-data-storage.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-iac-security.md, codeguard-0-input-validation-injection.md, codeguard-0-logging.md, codeguard-0-safe-c-functions.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md | | cpp | codeguard-0-safe-c-functions.md | | d | codeguard-0-iac-security.md | | docker | codeguard-0-devops-ci-cd-containers.md, codeguard-0-supply-chain-security.md | | go | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md | | hcl | codeguard-0-iac-security.md | | html | codeguard-0-client-side-web-security.md, codeguard-0-input-validation-injection.md, codeguard-0-session-management-and-cookies.md | | java | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-mobile-apps.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md | | javascript | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-client-side-web-security.md, codeguard-0-cloud-orchestration-kubernetes.md, codeguard-0-data-storage.md, codeguard-0-devops-ci-cd-containers.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-iac-security.md, codeguard-0-input-validation-injection.md, codeguard-0-logging.md, codeguard-0-mcp-security.md, codeguard-0-mobile-apps.md, codeguard-0-privacy-data-protection.md, codeguard-0-session-management-and-cookies.md, codeguard-0-supply-chain-security.md | | kotlin | codeguard-0-additional-cryptography.md, codeguard-0-authentication-mfa.md, codeguard-0-framework-and-languages.md, codeguard-0-mobile-apps.md | | matlab | codeguard-0-additional-cryptography.md, codeguard-0-authentication-mfa.md, codeguard-0-mobile-apps.md, codeguard-0-privacy-data-protection.md | | perl | codeguard-0-mobile-apps.md | | php | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-client-side-web-security.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md | | powershell | codeguard-0-devops-ci-cd-containers.md, codeguard-0-iac-security.md, codeguard-0-input-validation-injection.md | | python | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md | | ruby | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-iac-security.md, codeguard-0-input-validation-injection.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md | | rust | codeguard-0-mcp-security.md | | shell | codeguard-0-devops-ci-cd-containers.md, codeguard-0-iac-security.md, codeguard-0-input-validation-injection.md | | sql | codeguard-0-data-storage.md, codeguard-0-input-validation-injection.md | | swift | codeguard-0-additional-cryptography.md, codeguard-0-authentication-mfa.md, codeguard-0-mobile-apps.md | | typescript | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-client-side-web-security.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-session-management-and-cookies.md | | vlang | codeguard-0-client-side-web-security.md | | xml | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-devops-ci-cd-containers.md, codeguard-0-framework-and-languages.md, codeguard-0-mobile-apps.md, codeguard-0-xml-and-serialization.md | | yaml | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authorization-access-control.md, codeguard-0-cloud-orchestration-kubernetes.md, codeguard-0-data-storage.md, codeguard-0-devops-ci-cd-containers.md, codeguard-0-framework-and-languages.md, codeguard-0-iac-security.md, codeguard-0-logging.md, codeguard-0-privacy-data-protection.md, codeguard-0-supply-chain-security.md |
4. 主动安全：不要只是避免漏洞，还要主动实施安全模式：

• 对数据库访问使用参数化查询
• 验证并清理所有用户输入
• 遵循最小权限原则
• 使用现代加密算法和库
• 实施纵深防御策略

CodeGuard 安全规则

安全规则位于 rules/ 目录中。

使用工作流

生成或审查代码时，请遵循以下工作流：

1. 初始安全检查

编写任何代码之前：

• 检查：是否会处理凭据？→ 应用 codeguard-1-hardcoded-credentials
• 检查：适用哪些安全标签？→ 加载所有带有匹配标签（例如“authentication”“web”“secrets”）的规则
• 检查：使用什么语言？→ 确定适用的特定语言规则

2. 代码生成

编写代码时：

• 应用相关 Project CodeGuard 规则中的安全默认模式
• 添加与安全相关的注释，说明所做的选择

3. 安全审查

编写代码后：

• 对照每条规则中的实施检查清单进行审查
• 确认不存在硬编码凭据或机密信息
• 验证所有规则在适用时均已成功遵循。
• 说明应用了哪些安全规则
• 突出已实施的安全功能