code-security

Code Security is a defensive secure-coding reference for Claude, contributed by Semgrep, that supplies security rules for writing and reviewing code across 15+ languages. It addresses the common failure where code that handles user input, authentication, database queries, file operations, network requests, cryptography, or infrastructure configuration ships with well-known vulnerability classes. The skill is designed to be consulted proactively while writing code, not only when a user explicitly asks about security, mapping the OWASP Top 10 and infrastructure hardening into 28 rule categories.

The skill organizes rules by impact level and by language priority. A SKILL.md index routes to per-category rule files under rules/ covering critical issues (SQL injection, command injection, XSS, XXE, path traversal, insecure deserialization, code injection, hardcoded secrets, memory safety), high-impact issues (weak crypto, insecure transport, SSRF, JWT verification, CSRF, prototype pollution, unsafe functions), and infrastructure misconfigurations for Terraform on AWS/Azure/GCP, Kubernetes, Docker, and GitHub Actions, plus medium and low categories for ReDoS, race conditions, correctness, best practices, performance, and maintainability. Each rule file provides vulnerable-versus-secure code examples and CWE references so the guidance can be applied while writing or used to flag issues during review.

It targets developers and code reviewers who want defensive security folded into everyday coding, and is well suited to language-specific hardening, pre-commit review, and infrastructure-as-code audits. Although it enumerates vulnerability classes, the intent and framing are entirely protective — teaching secure patterns and how to avoid the insecure ones.