# code-security

Security guidelines for writing safe code and catching vulnerabilities across 15+ languages. Helps inspect database queries, network calls, and infrastructure configurations.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2600 installs · ★ 332
- Author: semgrep
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/semgrep/skills/tree/HEAD/skills/code-security/SKILL.md
- Updated: 2026-07-28
- HTML: https://affpapa.org/en/nevibecode/skills/code-security

## What it does

This skill equips the agent with defensive coding guidelines across 15+ programming languages. It compiles 28 rule categories covering OWASP Top 10 vulnerabilities, cryptography flaws, and infrastructure security. Rules are organized by severity levels, starting from SQL injection and hardcoded credentials down to race conditions or regular expression denial of service.

Guidance files live in the `rules/` directory with explicit code samples demonstrating vulnerable and corrected implementations. The repository highlights priority checks for stacks such as Python, JavaScript, TypeScript, Go, Java, C/C++, Ruby, PHP, and HCL or YAML configurations. The assistant references these files whenever it spots input handling, database queries, XML parsing, or when explicitly asked.

Infrastructure checks specifically target Terraform configurations across AWS, Azure, and GCP, alongside Docker, Kubernetes, and GitHub Actions manifests. Without these configuration files present in your workspace, the corresponding checks remain idle.

## Requirements
- Works with: Docker, Kubernetes, Terraform

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill code-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/code-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/code-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill code-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/code-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill code-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/code-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install semgrep/skills code-security
```

2. **Manually: put the files in place**
- File: `.github/skills/code-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill code-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/semgrep/skills --path skills/code-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/code-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill code-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/semgrep/skills/tree/HEAD/skills/code-security/SKILL.md

## When to use it
- catch SQL injection and command injection flaws in application code
- audit Terraform, Kubernetes, and Docker manifests for security misconfigurations
- replace weak hashing and encryption with SHA-256 and AES-256
- detect hardcoded secrets and API credentials
- prevent path traversal vulnerabilities during file operations

## Example prompts
- Check this query handler for SQL injection and unsanitized parameters
- Inspect my Dockerfile and Kubernetes manifests for security issues
- Is this file reading logic vulnerable to path traversal?

## Similar
- [config-scan](https://affpapa.org/en/nevibecode/skills/config-scan.md) — skill · 337 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs
- [code-review-security](https://affpapa.org/en/nevibecode/skills/code-review-security.md) — skill · 438 installs
- [devops-deployment](https://affpapa.org/en/nevibecode/skills/devops-deployment.md) — skill · 1600 installs
- [security-testing](https://affpapa.org/en/nevibecode/skills/security-testing.md) — skill · 1100 installs
- [security-auditor](https://affpapa.org/en/nevibecode/skills/sickn33-security-auditor.md) — skill · 1400 installs

From the same set: [semgrep/skills](https://affpapa.org/en/nevibecode/by/semgrep/skills.md) — 2 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md