Code Security
When to Use
- Write or review application code for common vulnerability classes (injection, XSS, auth, crypto, SSRF, XXE, deserialization)
- Review secrets handling, session/JWT patterns, and transport security in code
- Review Terraform, Kubernetes manifests, Dockerfiles, or GitHub Actions for security misconfigurations
- Proactively harden code that accepts user input, performs I/O, queries databases, or calls external URLs
- Map findings to CWE/OWASP categories and suggest concrete secure patterns
When NOT to Use
- Plan or execute authorized penetration tests, exploit chains, or red-team campaigns →
ai-redteam, cybersecurity, penetration-tester, red-team-specialist
- Map controls to SOC 2, ISO 27001, or build audit evidence packages →
compliance-engineer, compliance-specialist
- Deploy SIEM, IdP, KMS, WAF, or operate security tooling →
information-security-engineer
- Configure CI/CD scanners, SBOM, OIDC, or pipeline gates without secure-coding review →
devsecops
- Author YARA or malware detection rules →
yara-rule-authoring
- General feature design, RFCs, or refactoring without a security lens →
senior-software-engineer
Related skills
| Need |
Skill |
| Security program strategy, policies, IR |
cybersecurity |
| Control implementation, IdP, KMS, SIEM |
information-security-engineer |
| CI/CD security gates, SBOM, pipeline OIDC |
devsecops |
| Audit evidence and framework mapping |
compliance-engineer |
| LLM/agent red team and prompt injection |
ai-redteam |
| Code review, RFCs, reliability (non-security) |
senior-software-engineer |
| Cloud account guardrails and CSPM |
cloud-security-engineer |
| Cryptographic primitive/protocol design |
cryptographer-specialist |
| Pentest findings reproduction |
penetration-tester, web-pentester |
How to work
Modes
- Proactive — When writing or touching security-sensitive code (input, auth, files, DB, HTTP clients, crypto, IaC), check relevant categories without waiting for an explicit security ask.
- Reactive — When the user requests a security review, follow the review workflow in
references/review_checklist_and_owasp_mapping.md.
Workflow
- Identify language/stack and what the code does (input? DB? shell? XML? outbound HTTP? secrets? IaC?).
- Load the matching reference(s) below; prioritize Critical then High impact.
- Flag vulnerable patterns with CWE/OWASP labels; propose secure alternatives from references (language-specific examples live there).
- For reviews, produce severity-ordered findings with file/line context and fix guidance.
Language priority (first checks)
| Language / stack |
Priority topics |
| Python |
SQL/command injection, path traversal, code injection, SSRF, insecure crypto, deserialization |
| JavaScript/TypeScript |
XSS, prototype pollution, code injection, CSRF, insecure transport |
| Java |
SQL injection, XXE, insecure deserialization, SSRF, insecure crypto |
| Go |
SQL/command injection, path traversal, SSRF, insecure transport |
| C/C++ |
Memory safety, unsafe functions, command injection, path traversal |
| Ruby / PHP |
SQL/command injection, XSS, deserialization (Ruby), code injection |
| HCL / YAML |
Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions |
When to load references
Detailed vulnerable/secure patterns and multi-language examples are in references/ (condensed from 28 upstream rule categories). Do not expect per-language copies of every rule in SKILL.md.
| Topic |
Reference |
| Scope, modes, language priorities |
references/code_security_scope_and_workflow.md |
| SQL, command, XSS, path traversal, code injection |
references/injection_and_input_validation.md |
| Secrets, JWT, CSRF, crypto, TLS |
references/crypto_auth_and_session.md |
| XXE, deserialization, SSRF |
references/deserialization_ssrf_xxe.md |
| Terraform, K8s, Docker, GitHub Actions |
references/infrastructure_as_code_security.md |
| Review checklist, CWE/OWASP map, medium/low |
references/review_checklist_and_owasp_mapping.md |
Quick prevention reference
| Vulnerability |
Key prevention |
| SQL injection |
Parameterized queries / prepared statements |
| XSS |
Context-aware output encoding; CSP where appropriate |
| Command injection |
Avoid shell; use APIs with argument lists |
| Path traversal |
Canonicalize paths; allowlist base directories |
| SSRF |
URL allowlists; block metadata/link-local ranges |
| Secrets |
Env vars / secret managers; never commit credentials |
| Weak crypto |
SHA-256+, AES-256-GCM; avoid MD5/SHA1/DES/ECB |
| XXE |
Disable DTD/external entities in XML parsers |
| Deserialization |
Do not deserialize untrusted data |
