askill
semgrep-code-security

semgrep-code-securitySafety 90Repository

Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like "check for SQL injection" or "review security".

0 stars
1.2k downloads
Updated 2/11/2026

Package Files

Loading files...
SKILL.md

Code Security Guidelines

Comprehensive security rules for writing secure code across multiple languages and frameworks. Covers OWASP Top 10 vulnerabilities, infrastructure security, and coding best practices.

How It Works

  1. When you write or review code, reference these security guidelines
  2. Each rule includes incorrect (vulnerable) and correct (secure) code examples
  3. Rules are organized by vulnerability category and impact level

Categories

Critical Impact

  • SQL Injection - Use parameterized queries, never concatenate user input
  • Command Injection - Avoid shell commands with user input, use safe APIs
  • XSS - Escape output, use framework protections
  • XXE - Disable external entities in XML parsers
  • Path Traversal - Validate and sanitize file paths
  • Insecure Deserialization - Never deserialize untrusted data
  • Code Injection - Never eval() user input
  • Hardcoded Secrets - Use environment variables or secret managers
  • Memory Safety - Prevent buffer overflows, use-after-free (C/C++)

High Impact

  • Insecure Crypto - Use SHA-256+, AES-256, avoid MD5/SHA1/DES
  • Insecure Transport - Use HTTPS, verify certificates
  • SSRF - Validate URLs, use allowlists
  • JWT Issues - Always verify signatures
  • CSRF - Use CSRF tokens on state-changing requests
  • Prototype Pollution - Validate object keys in JavaScript

Infrastructure

  • Terraform AWS/Azure/GCP - Encryption, least privilege, no public access
  • Kubernetes - No privileged containers, run as non-root
  • Docker - Don't run as root, pin image versions
  • GitHub Actions - Avoid script injection, pin action versions

Usage

Reference the rules in rules/ directory for detailed examples:

  • rules/sql-injection.md - SQL injection prevention
  • rules/xss.md - Cross-site scripting prevention
  • rules/command-injection.md - Command injection prevention
  • rules/_sections.md - Full index of all 28 rule categories

Quick Reference

VulnerabilityKey Prevention
SQL InjectionParameterized queries
XSSOutput encoding
Command InjectionAvoid shell, use APIs
Path TraversalValidate paths
SSRFURL allowlists
SecretsEnvironment variables
CryptoSHA-256, AES-256

Install

Download ZIP
Requires askill CLI v1.0+

AI Quality Score

66/100Analyzed 2/20/2026

Well-organized security reference skill covering OWASP Top 10 and infrastructure security with good metadata (tags, description). Provides categorized vulnerability list and quick reference table. Main weaknesses: lacks step-by-step instructions, and references external rule files (rules/) that may not exist or be accessible. Content is clear and reusable but requires the external files to be truly actionable. Good bonus from having clear usage context, tags, and being in dedicated skills folder."

90
70
80
55
50

Metadata

Licenseunknown
Version-
Updated2/11/2026
Publisherkristovatlas

Tags

databasegithubgithub-actionssecurity