code-security

---
name: code-security
description: |
license: MIT
---

# Code Security

## When to Use

- Write or review application code for common vulnerability classes (injection, XSS, auth, crypto, SSRF, XXE, deserialization)
- Review secrets handling, session/JWT patterns, and transport security in code
- Review Terraform, Kubernetes manifests, Dockerfiles, or GitHub Actions for security misconfigurations
- Proactively harden code that accepts user input, performs I/O, queries databases, or calls external URLs
- Map findings to CWE/OWASP categories and suggest concrete secure patterns

## When NOT to Use

- Plan or execute authorized penetration tests, exploit chains, or red-team campaigns → `ai-redteam`, `cybersecurity`, `penetration-tester`, `red-team-specialist`
- Map controls to SOC 2, ISO 27001, or build audit evidence packages → `compliance-engineer`, `compliance-specialist`
- Deploy SIEM, IdP, KMS, WAF, or operate security tooling → `information-security-engineer`
- Configure CI/CD scanners, SBOM, OIDC, or pipeline gates without secure-coding review → `devsecops`
- Author YARA or malware detection rules → `yara-rule-authoring`
- General feature design, RFCs, or refactoring without a security lens → `senior-software-engineer`

## Related skills

| Need | Skill |
|---|---|
| Security program strategy, policies, IR | `cybersecurity` |
| Control implementation, IdP, KMS, SIEM | `information-security-engineer` |
| CI/CD security gates, SBOM, pipeline OIDC | `devsecops` |
| Audit evidence and framework mapping | `compliance-engineer` |
| LLM/agent red team and prompt injection | `ai-redteam` |
| Code review, RFCs, reliability (non-security) | `senior-software-engineer` |
| Cloud account guardrails and CSPM | `cloud-security-engineer` |
| Cryptographic primitive/protocol design | `cryptographer-specialist` |
| Pentest findings reproduction | `penetration-tester`, `web-pentester` |

## How to work

### Modes

- **Proactive** — When writing or touching security-sensitive code (input, auth, files, DB, HTTP clients, crypto, IaC), check relevant categories without waiting for an explicit security ask.
- **Reactive** — When the user requests a security review, follow the review workflow in `references/review_checklist_and_owasp_mapping.md`.

### Workflow

1. Identify language/stack and what the code does (input? DB? shell? XML? outbound HTTP? secrets? IaC?).
2. Load the matching reference(s) below; prioritize **Critical** then **High** impact.
3. Flag vulnerable patterns with CWE/OWASP labels; propose secure alternatives from references (language-specific examples live there).
4. For reviews, produce severity-ordered findings with file/line context and fix guidance.

### Language priority (first checks)

| Language / stack | Priority topics |
|---|---|
| Python | SQL/command injection, path traversal, code injection, SSRF, insecure crypto, deserialization |
| JavaScript/TypeScript | XSS, prototype pollution, code injection, CSRF, insecure transport |
| Java | SQL injection, XXE, insecure deserialization, SSRF, insecure crypto |
| Go | SQL/command injection, path traversal, SSRF, insecure transport |
| C/C++ | Memory safety, unsafe functions, command injection, path traversal |
| Ruby / PHP | SQL/command injection, XSS, deserialization (Ruby), code injection |
| HCL / YAML | Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions |

## When to load references

Detailed vulnerable/secure patterns and multi-language examples are in `references/` (condensed from 28 upstream rule categories). Do not expect per-language copies of every rule in `SKILL.md`.

| Topic | Reference |
|---|---|
| Scope, modes, language priorities | `references/code_security_scope_and_workflow.md` |
| SQL, command, XSS, path traversal, code injection | `references/injection_and_input_validation.md` |
| Secrets, JWT, CSRF, crypto, TLS | `references/crypto_auth_and_session.md` |
| XXE, deserialization, SSRF | `references/deserialization_ssrf_xxe.md` |
| Terraform, K8s, Docker, GitHub Actions | `references/infrastructure_as_code_security.md` |
| Review checklist, CWE/OWASP map, medium/low | `references/review_checklist_and_owasp_mapping.md` |

## Quick prevention reference

| Vulnerability | Key prevention |
|---|---|
| SQL injection | Parameterized queries / prepared statements |
| XSS | Context-aware output encoding; CSP where appropriate |
| Command injection | Avoid shell; use APIs with argument lists |
| Path traversal | Canonicalize paths; allowlist base directories |
| SSRF | URL allowlists; block metadata/link-local ranges |
| Secrets | Env vars / secret managers; never commit credentials |
| Weak crypto | SHA-256+, AES-256-GCM; avoid MD5/SHA1/DES/ECB |
| XXE | Disable DTD/external entities in XML parsers |
| Deserialization | Do not deserialize untrusted data |