code-security — Claude Code skill: what it does, how to install
Security guidelines for writing safe code and catching vulnerabilities across 15+ languages. Helps inspect database queries, network calls, and infrastructure configurations.
npx skills add semgrep/skills --skill code-security -a claude-codeWhat code-security does
This skill equips the agent with defensive coding guidelines across 15+ programming languages. It compiles 28 rule categories covering OWASP Top 10 vulnerabilities, cryptography flaws, and infrastructure security. Rules are organized by severity levels, starting from SQL injection and hardcoded credentials down to race conditions or regular expression denial of service.
Guidance files live in the rules/ directory with explicit code samples demonstrating vulnerable and corrected implementations. The repository highlights priority checks for stacks such as Python, JavaScript, TypeScript, Go, Java, C/C++, Ruby, PHP, and HCL or YAML configurations. The assistant references these files whenever it spots input handling, database queries, XML parsing, or when explicitly asked.
Infrastructure checks specifically target Terraform configurations across AWS, Azure, and GCP, alongside Docker, Kubernetes, and GitHub Actions manifests. Without these configuration files present in your workspace, the corresponding checks remain idle.
What it helps with
- catch SQL injection and command injection flaws in application code
- audit Terraform, Kubernetes, and Docker manifests for security misconfigurations
- replace weak hashing and encryption with SHA-256 and AES-256
- detect hardcoded secrets and API credentials
- prevent path traversal vulnerabilities during file operations
Example prompts for the agent
- Check this query handler for SQL injection and unsanitized parameters
- Inspect my Dockerfile and Kubernetes manifests for security issues
- Is this file reading logic vulnerable to path traversal?
How to install code-security
1Skills CLI (Vercel)
npx skills add semgrep/skills --skill code-security -a claude-code2Manually: put the files in place
~/.claude/skills/code-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/code-security/
1Skills CLI (Vercel)
npx skills add semgrep/skills --skill code-security -a codex2Manually: put the files in place
.agents/skills/code-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add semgrep/skills --skill code-security -a cursor2Manually: put the files in place
.cursor/skills/code-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install semgrep/skills code-security2Manually: put the files in place
.github/skills/code-security/SKILL.md1Skills CLI (Vercel)
npx skills add semgrep/skills --skill code-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/semgrep/skills --path skills/code-securityManually: put the files in place
.devin/skills/code-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add semgrep/skills --skill code-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about code-security
How to install code-security in Claude Code?
Run npx skills add semgrep/skills --skill code-security -a claude-code in your terminal.
What does the code-security skill do?
It gives the agent a reference set of 28 security categories covering OWASP Top 10 risks, crypto best practices, and secure configuration templates for writing and reviewing code.
Which languages and frameworks does this skill inspect?
The skill provides guidance across 15+ languages including Python, JavaScript, TypeScript, Java, Go, C/C++, Ruby, and PHP. It also covers infrastructure manifests for Docker, Kubernetes, GitHub Actions, and Terraform across AWS, Azure, and GCP.
