[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-semgrep-code-security":3,"mdc-5vgtyy-key":36,"related-org-semgrep-code-security":869,"related-repo-semgrep-code-security":940},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":31,"sourceUrl":34,"mdContent":35},"code-security","write and review secure code","Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"semgrep","Semgrep","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fsemgrep.png",[12,16,19],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},"Code Review","code-review",257,"https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fskills","2026-04-06T18:52:52.030224",null,28,[28,29,14,30],"agents","claude-code","skills",{"repoUrl":23,"stars":22,"forks":26,"topics":32,"description":33},[28,29,14,30],"A collection of skills for AI coding agents from Semgrep","https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fcode-security","---\nname: code-security\ndescription: \"Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'.\"\n---\n\n# Code Security Guidelines\n\nComprehensive security rules for writing secure code across 15+ languages. Covers OWASP Top 10, infrastructure security, and coding best practices with 28 rule categories.\n\n## How to Use This Skill\n\n**Proactive mode** — When writing or reviewing code, automatically check for relevant vulnerabilities based on the language and patterns present. You don't need to wait for the user to ask about security.\n\n**Reactive mode** — When the user asks about security, use the categories below to find the relevant rule file, then read it for detailed vulnerable\u002Fsecure code examples.\n\n### Workflow\n1. Identify the language and what the code does (handles input? queries a DB? reads files?)\n2. Check the relevant rules below — focus on Critical and High impact first\n3. Read the specific rule file from `rules\u002F` for detailed code examples in that language\n4. Apply the secure patterns, or flag the vulnerable patterns if reviewing\n\n## Language-Specific Priority Rules\n\nWhen writing code in these languages, check these rules first:\n\n| Language | Priority Rules to Check |\n|----------|------------------------|\n| **Python** | SQL injection, command injection, path traversal, code injection, SSRF, insecure crypto |\n| **JavaScript\u002FTypeScript** | XSS, prototype pollution, code injection, insecure transport, CSRF |\n| **Java** | SQL injection, XXE, insecure deserialization, insecure crypto, SSRF |\n| **Go** | SQL injection, command injection, path traversal, insecure transport |\n| **C\u002FC++** | Memory safety, unsafe functions, command injection, path traversal |\n| **Ruby** | SQL injection, command injection, code injection, insecure deserialization |\n| **PHP** | SQL injection, XSS, command injection, code injection, path traversal |\n| **HCL\u002FYAML** | Terraform (AWS\u002FAzure\u002FGCP), Kubernetes, Docker, GitHub Actions |\n\n## Categories\n\n### Critical Impact\n- **SQL Injection** (`rules\u002Fsql-injection.md`) - Use parameterized queries, never concatenate user input\n- **Command Injection** (`rules\u002Fcommand-injection.md`) - Avoid shell commands with user input, use safe APIs\n- **XSS** (`rules\u002Fxss.md`) - Escape output, use framework protections\n- **XXE** (`rules\u002Fxxe.md`) - Disable external entities in XML parsers\n- **Path Traversal** (`rules\u002Fpath-traversal.md`) - Validate and sanitize file paths\n- **Insecure Deserialization** (`rules\u002Finsecure-deserialization.md`) - Never deserialize untrusted data\n- **Code Injection** (`rules\u002Fcode-injection.md`) - Never eval() user input\n- **Hardcoded Secrets** (`rules\u002Fsecrets.md`) - Use environment variables or secret managers\n- **Memory Safety** (`rules\u002Fmemory-safety.md`) - Prevent buffer overflows, use-after-free (C\u002FC++)\n\n### High Impact\n- **Insecure Crypto** (`rules\u002Finsecure-crypto.md`) - Use SHA-256+, AES-256, avoid MD5\u002FSHA1\u002FDES\n- **Insecure Transport** (`rules\u002Finsecure-transport.md`) - Use HTTPS, verify certificates\n- **SSRF** (`rules\u002Fssrf.md`) - Validate URLs, use allowlists\n- **JWT Issues** (`rules\u002Fauthentication-jwt.md`) - Always verify signatures\n- **CSRF** (`rules\u002Fcsrf.md`) - Use CSRF tokens on state-changing requests\n- **Prototype Pollution** (`rules\u002Fprototype-pollution.md`) - Validate object keys in JavaScript\n\n### Infrastructure\n- **Terraform AWS\u002FAzure\u002FGCP** (`rules\u002Fterraform-aws.md`, `rules\u002Fterraform-azure.md`, `rules\u002Fterraform-gcp.md`) - Encryption, least privilege, no public access\n- **Kubernetes** (`rules\u002Fkubernetes.md`) - No privileged containers, run as non-root\n- **Docker** (`rules\u002Fdocker.md`) - Don't run as root, pin image versions\n- **GitHub Actions** (`rules\u002Fgithub-actions.md`) - Avoid script injection, pin action versions\n\n### Medium\u002FLow Impact\n- **Regex DoS** (`rules\u002Fregex-dos.md`) - Avoid catastrophic backtracking\n- **Race Conditions** (`rules\u002Frace-condition.md`) - Use proper synchronization\n- **Correctness** (`rules\u002Fcorrectness.md`) - Avoid common logic bugs\n- **Best Practices** (`rules\u002Fbest-practice.md`) - General secure coding patterns\n\nSee `rules\u002F_sections.md` for the full index with CWE\u002FOWASP references.\n\n## Quick Reference\n\n| Vulnerability | Key Prevention |\n|--------------|----------------|\n| SQL Injection | Parameterized queries |\n| XSS | Output encoding |\n| Command Injection | Avoid shell, use APIs |\n| Path Traversal | Validate paths |\n| SSRF | URL allowlists |\n| Secrets | Environment variables |\n| Crypto | SHA-256, AES-256 |\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,50,56,63,74,84,91,125,131,136,292,298,304,462,468,573,579,665,671,742,755,761],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"code-security-guidelines",[47],{"type":48,"value":49},"text","Code Security Guidelines",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54],{"type":48,"value":55},"Comprehensive security rules for writing secure code across 15+ languages. Covers OWASP Top 10, infrastructure security, and coding best practices with 28 rule categories.",{"type":42,"tag":57,"props":58,"children":60},"h2",{"id":59},"how-to-use-this-skill",[61],{"type":48,"value":62},"How to Use This Skill",{"type":42,"tag":51,"props":64,"children":65},{},[66,72],{"type":42,"tag":67,"props":68,"children":69},"strong",{},[70],{"type":48,"value":71},"Proactive mode",{"type":48,"value":73}," — When writing or reviewing code, automatically check for relevant vulnerabilities based on the language and patterns present. You don't need to wait for the user to ask about security.",{"type":42,"tag":51,"props":75,"children":76},{},[77,82],{"type":42,"tag":67,"props":78,"children":79},{},[80],{"type":48,"value":81},"Reactive mode",{"type":48,"value":83}," — When the user asks about security, use the categories below to find the relevant rule file, then read it for detailed vulnerable\u002Fsecure code examples.",{"type":42,"tag":85,"props":86,"children":88},"h3",{"id":87},"workflow",[89],{"type":48,"value":90},"Workflow",{"type":42,"tag":92,"props":93,"children":94},"ol",{},[95,101,106,120],{"type":42,"tag":96,"props":97,"children":98},"li",{},[99],{"type":48,"value":100},"Identify the language and what the code does (handles input? queries a DB? reads files?)",{"type":42,"tag":96,"props":102,"children":103},{},[104],{"type":48,"value":105},"Check the relevant rules below — focus on Critical and High impact first",{"type":42,"tag":96,"props":107,"children":108},{},[109,111,118],{"type":48,"value":110},"Read the specific rule file from ",{"type":42,"tag":112,"props":113,"children":115},"code",{"className":114},[],[116],{"type":48,"value":117},"rules\u002F",{"type":48,"value":119}," for detailed code examples in that language",{"type":42,"tag":96,"props":121,"children":122},{},[123],{"type":48,"value":124},"Apply the secure patterns, or flag the vulnerable patterns if reviewing",{"type":42,"tag":57,"props":126,"children":128},{"id":127},"language-specific-priority-rules",[129],{"type":48,"value":130},"Language-Specific Priority Rules",{"type":42,"tag":51,"props":132,"children":133},{},[134],{"type":48,"value":135},"When writing code in these languages, check these rules first:",{"type":42,"tag":137,"props":138,"children":139},"table",{},[140,159],{"type":42,"tag":141,"props":142,"children":143},"thead",{},[144],{"type":42,"tag":145,"props":146,"children":147},"tr",{},[148,154],{"type":42,"tag":149,"props":150,"children":151},"th",{},[152],{"type":48,"value":153},"Language",{"type":42,"tag":149,"props":155,"children":156},{},[157],{"type":48,"value":158},"Priority Rules to Check",{"type":42,"tag":160,"props":161,"children":162},"tbody",{},[163,180,196,212,228,244,260,276],{"type":42,"tag":145,"props":164,"children":165},{},[166,175],{"type":42,"tag":167,"props":168,"children":169},"td",{},[170],{"type":42,"tag":67,"props":171,"children":172},{},[173],{"type":48,"value":174},"Python",{"type":42,"tag":167,"props":176,"children":177},{},[178],{"type":48,"value":179},"SQL injection, command injection, path traversal, code injection, SSRF, insecure crypto",{"type":42,"tag":145,"props":181,"children":182},{},[183,191],{"type":42,"tag":167,"props":184,"children":185},{},[186],{"type":42,"tag":67,"props":187,"children":188},{},[189],{"type":48,"value":190},"JavaScript\u002FTypeScript",{"type":42,"tag":167,"props":192,"children":193},{},[194],{"type":48,"value":195},"XSS, prototype pollution, code injection, insecure transport, CSRF",{"type":42,"tag":145,"props":197,"children":198},{},[199,207],{"type":42,"tag":167,"props":200,"children":201},{},[202],{"type":42,"tag":67,"props":203,"children":204},{},[205],{"type":48,"value":206},"Java",{"type":42,"tag":167,"props":208,"children":209},{},[210],{"type":48,"value":211},"SQL injection, XXE, insecure deserialization, insecure crypto, SSRF",{"type":42,"tag":145,"props":213,"children":214},{},[215,223],{"type":42,"tag":167,"props":216,"children":217},{},[218],{"type":42,"tag":67,"props":219,"children":220},{},[221],{"type":48,"value":222},"Go",{"type":42,"tag":167,"props":224,"children":225},{},[226],{"type":48,"value":227},"SQL injection, command injection, path traversal, insecure transport",{"type":42,"tag":145,"props":229,"children":230},{},[231,239],{"type":42,"tag":167,"props":232,"children":233},{},[234],{"type":42,"tag":67,"props":235,"children":236},{},[237],{"type":48,"value":238},"C\u002FC++",{"type":42,"tag":167,"props":240,"children":241},{},[242],{"type":48,"value":243},"Memory safety, unsafe functions, command injection, path traversal",{"type":42,"tag":145,"props":245,"children":246},{},[247,255],{"type":42,"tag":167,"props":248,"children":249},{},[250],{"type":42,"tag":67,"props":251,"children":252},{},[253],{"type":48,"value":254},"Ruby",{"type":42,"tag":167,"props":256,"children":257},{},[258],{"type":48,"value":259},"SQL injection, command injection, code injection, insecure deserialization",{"type":42,"tag":145,"props":261,"children":262},{},[263,271],{"type":42,"tag":167,"props":264,"children":265},{},[266],{"type":42,"tag":67,"props":267,"children":268},{},[269],{"type":48,"value":270},"PHP",{"type":42,"tag":167,"props":272,"children":273},{},[274],{"type":48,"value":275},"SQL injection, XSS, command injection, code injection, path traversal",{"type":42,"tag":145,"props":277,"children":278},{},[279,287],{"type":42,"tag":167,"props":280,"children":281},{},[282],{"type":42,"tag":67,"props":283,"children":284},{},[285],{"type":48,"value":286},"HCL\u002FYAML",{"type":42,"tag":167,"props":288,"children":289},{},[290],{"type":48,"value":291},"Terraform (AWS\u002FAzure\u002FGCP), Kubernetes, Docker, GitHub Actions",{"type":42,"tag":57,"props":293,"children":295},{"id":294},"categories",[296],{"type":48,"value":297},"Categories",{"type":42,"tag":85,"props":299,"children":301},{"id":300},"critical-impact",[302],{"type":48,"value":303},"Critical Impact",{"type":42,"tag":305,"props":306,"children":307},"ul",{},[308,326,343,360,377,394,411,428,445],{"type":42,"tag":96,"props":309,"children":310},{},[311,316,318,324],{"type":42,"tag":67,"props":312,"children":313},{},[314],{"type":48,"value":315},"SQL Injection",{"type":48,"value":317}," (",{"type":42,"tag":112,"props":319,"children":321},{"className":320},[],[322],{"type":48,"value":323},"rules\u002Fsql-injection.md",{"type":48,"value":325},") - Use parameterized queries, never concatenate user input",{"type":42,"tag":96,"props":327,"children":328},{},[329,334,335,341],{"type":42,"tag":67,"props":330,"children":331},{},[332],{"type":48,"value":333},"Command Injection",{"type":48,"value":317},{"type":42,"tag":112,"props":336,"children":338},{"className":337},[],[339],{"type":48,"value":340},"rules\u002Fcommand-injection.md",{"type":48,"value":342},") - Avoid shell commands with user input, use safe APIs",{"type":42,"tag":96,"props":344,"children":345},{},[346,351,352,358],{"type":42,"tag":67,"props":347,"children":348},{},[349],{"type":48,"value":350},"XSS",{"type":48,"value":317},{"type":42,"tag":112,"props":353,"children":355},{"className":354},[],[356],{"type":48,"value":357},"rules\u002Fxss.md",{"type":48,"value":359},") - Escape output, use framework protections",{"type":42,"tag":96,"props":361,"children":362},{},[363,368,369,375],{"type":42,"tag":67,"props":364,"children":365},{},[366],{"type":48,"value":367},"XXE",{"type":48,"value":317},{"type":42,"tag":112,"props":370,"children":372},{"className":371},[],[373],{"type":48,"value":374},"rules\u002Fxxe.md",{"type":48,"value":376},") - Disable external entities in XML parsers",{"type":42,"tag":96,"props":378,"children":379},{},[380,385,386,392],{"type":42,"tag":67,"props":381,"children":382},{},[383],{"type":48,"value":384},"Path Traversal",{"type":48,"value":317},{"type":42,"tag":112,"props":387,"children":389},{"className":388},[],[390],{"type":48,"value":391},"rules\u002Fpath-traversal.md",{"type":48,"value":393},") - Validate and sanitize file paths",{"type":42,"tag":96,"props":395,"children":396},{},[397,402,403,409],{"type":42,"tag":67,"props":398,"children":399},{},[400],{"type":48,"value":401},"Insecure Deserialization",{"type":48,"value":317},{"type":42,"tag":112,"props":404,"children":406},{"className":405},[],[407],{"type":48,"value":408},"rules\u002Finsecure-deserialization.md",{"type":48,"value":410},") - Never deserialize untrusted data",{"type":42,"tag":96,"props":412,"children":413},{},[414,419,420,426],{"type":42,"tag":67,"props":415,"children":416},{},[417],{"type":48,"value":418},"Code Injection",{"type":48,"value":317},{"type":42,"tag":112,"props":421,"children":423},{"className":422},[],[424],{"type":48,"value":425},"rules\u002Fcode-injection.md",{"type":48,"value":427},") - Never eval() user input",{"type":42,"tag":96,"props":429,"children":430},{},[431,436,437,443],{"type":42,"tag":67,"props":432,"children":433},{},[434],{"type":48,"value":435},"Hardcoded Secrets",{"type":48,"value":317},{"type":42,"tag":112,"props":438,"children":440},{"className":439},[],[441],{"type":48,"value":442},"rules\u002Fsecrets.md",{"type":48,"value":444},") - Use environment variables or secret managers",{"type":42,"tag":96,"props":446,"children":447},{},[448,453,454,460],{"type":42,"tag":67,"props":449,"children":450},{},[451],{"type":48,"value":452},"Memory Safety",{"type":48,"value":317},{"type":42,"tag":112,"props":455,"children":457},{"className":456},[],[458],{"type":48,"value":459},"rules\u002Fmemory-safety.md",{"type":48,"value":461},") - Prevent buffer overflows, use-after-free (C\u002FC++)",{"type":42,"tag":85,"props":463,"children":465},{"id":464},"high-impact",[466],{"type":48,"value":467},"High Impact",{"type":42,"tag":305,"props":469,"children":470},{},[471,488,505,522,539,556],{"type":42,"tag":96,"props":472,"children":473},{},[474,479,480,486],{"type":42,"tag":67,"props":475,"children":476},{},[477],{"type":48,"value":478},"Insecure Crypto",{"type":48,"value":317},{"type":42,"tag":112,"props":481,"children":483},{"className":482},[],[484],{"type":48,"value":485},"rules\u002Finsecure-crypto.md",{"type":48,"value":487},") - Use SHA-256+, AES-256, avoid MD5\u002FSHA1\u002FDES",{"type":42,"tag":96,"props":489,"children":490},{},[491,496,497,503],{"type":42,"tag":67,"props":492,"children":493},{},[494],{"type":48,"value":495},"Insecure Transport",{"type":48,"value":317},{"type":42,"tag":112,"props":498,"children":500},{"className":499},[],[501],{"type":48,"value":502},"rules\u002Finsecure-transport.md",{"type":48,"value":504},") - Use HTTPS, verify certificates",{"type":42,"tag":96,"props":506,"children":507},{},[508,513,514,520],{"type":42,"tag":67,"props":509,"children":510},{},[511],{"type":48,"value":512},"SSRF",{"type":48,"value":317},{"type":42,"tag":112,"props":515,"children":517},{"className":516},[],[518],{"type":48,"value":519},"rules\u002Fssrf.md",{"type":48,"value":521},") - Validate URLs, use allowlists",{"type":42,"tag":96,"props":523,"children":524},{},[525,530,531,537],{"type":42,"tag":67,"props":526,"children":527},{},[528],{"type":48,"value":529},"JWT Issues",{"type":48,"value":317},{"type":42,"tag":112,"props":532,"children":534},{"className":533},[],[535],{"type":48,"value":536},"rules\u002Fauthentication-jwt.md",{"type":48,"value":538},") - Always verify signatures",{"type":42,"tag":96,"props":540,"children":541},{},[542,547,548,554],{"type":42,"tag":67,"props":543,"children":544},{},[545],{"type":48,"value":546},"CSRF",{"type":48,"value":317},{"type":42,"tag":112,"props":549,"children":551},{"className":550},[],[552],{"type":48,"value":553},"rules\u002Fcsrf.md",{"type":48,"value":555},") - Use CSRF tokens on state-changing requests",{"type":42,"tag":96,"props":557,"children":558},{},[559,564,565,571],{"type":42,"tag":67,"props":560,"children":561},{},[562],{"type":48,"value":563},"Prototype Pollution",{"type":48,"value":317},{"type":42,"tag":112,"props":566,"children":568},{"className":567},[],[569],{"type":48,"value":570},"rules\u002Fprototype-pollution.md",{"type":48,"value":572},") - Validate object keys in JavaScript",{"type":42,"tag":85,"props":574,"children":576},{"id":575},"infrastructure",[577],{"type":48,"value":578},"Infrastructure",{"type":42,"tag":305,"props":580,"children":581},{},[582,614,631,648],{"type":42,"tag":96,"props":583,"children":584},{},[585,590,591,597,599,605,606,612],{"type":42,"tag":67,"props":586,"children":587},{},[588],{"type":48,"value":589},"Terraform AWS\u002FAzure\u002FGCP",{"type":48,"value":317},{"type":42,"tag":112,"props":592,"children":594},{"className":593},[],[595],{"type":48,"value":596},"rules\u002Fterraform-aws.md",{"type":48,"value":598},", ",{"type":42,"tag":112,"props":600,"children":602},{"className":601},[],[603],{"type":48,"value":604},"rules\u002Fterraform-azure.md",{"type":48,"value":598},{"type":42,"tag":112,"props":607,"children":609},{"className":608},[],[610],{"type":48,"value":611},"rules\u002Fterraform-gcp.md",{"type":48,"value":613},") - Encryption, least privilege, no public access",{"type":42,"tag":96,"props":615,"children":616},{},[617,622,623,629],{"type":42,"tag":67,"props":618,"children":619},{},[620],{"type":48,"value":621},"Kubernetes",{"type":48,"value":317},{"type":42,"tag":112,"props":624,"children":626},{"className":625},[],[627],{"type":48,"value":628},"rules\u002Fkubernetes.md",{"type":48,"value":630},") - No privileged containers, run as non-root",{"type":42,"tag":96,"props":632,"children":633},{},[634,639,640,646],{"type":42,"tag":67,"props":635,"children":636},{},[637],{"type":48,"value":638},"Docker",{"type":48,"value":317},{"type":42,"tag":112,"props":641,"children":643},{"className":642},[],[644],{"type":48,"value":645},"rules\u002Fdocker.md",{"type":48,"value":647},") - Don't run as root, pin image versions",{"type":42,"tag":96,"props":649,"children":650},{},[651,656,657,663],{"type":42,"tag":67,"props":652,"children":653},{},[654],{"type":48,"value":655},"GitHub Actions",{"type":48,"value":317},{"type":42,"tag":112,"props":658,"children":660},{"className":659},[],[661],{"type":48,"value":662},"rules\u002Fgithub-actions.md",{"type":48,"value":664},") - Avoid script injection, pin action versions",{"type":42,"tag":85,"props":666,"children":668},{"id":667},"mediumlow-impact",[669],{"type":48,"value":670},"Medium\u002FLow Impact",{"type":42,"tag":305,"props":672,"children":673},{},[674,691,708,725],{"type":42,"tag":96,"props":675,"children":676},{},[677,682,683,689],{"type":42,"tag":67,"props":678,"children":679},{},[680],{"type":48,"value":681},"Regex DoS",{"type":48,"value":317},{"type":42,"tag":112,"props":684,"children":686},{"className":685},[],[687],{"type":48,"value":688},"rules\u002Fregex-dos.md",{"type":48,"value":690},") - Avoid catastrophic backtracking",{"type":42,"tag":96,"props":692,"children":693},{},[694,699,700,706],{"type":42,"tag":67,"props":695,"children":696},{},[697],{"type":48,"value":698},"Race Conditions",{"type":48,"value":317},{"type":42,"tag":112,"props":701,"children":703},{"className":702},[],[704],{"type":48,"value":705},"rules\u002Frace-condition.md",{"type":48,"value":707},") - Use proper synchronization",{"type":42,"tag":96,"props":709,"children":710},{},[711,716,717,723],{"type":42,"tag":67,"props":712,"children":713},{},[714],{"type":48,"value":715},"Correctness",{"type":48,"value":317},{"type":42,"tag":112,"props":718,"children":720},{"className":719},[],[721],{"type":48,"value":722},"rules\u002Fcorrectness.md",{"type":48,"value":724},") - Avoid common logic bugs",{"type":42,"tag":96,"props":726,"children":727},{},[728,733,734,740],{"type":42,"tag":67,"props":729,"children":730},{},[731],{"type":48,"value":732},"Best Practices",{"type":48,"value":317},{"type":42,"tag":112,"props":735,"children":737},{"className":736},[],[738],{"type":48,"value":739},"rules\u002Fbest-practice.md",{"type":48,"value":741},") - General secure coding patterns",{"type":42,"tag":51,"props":743,"children":744},{},[745,747,753],{"type":48,"value":746},"See ",{"type":42,"tag":112,"props":748,"children":750},{"className":749},[],[751],{"type":48,"value":752},"rules\u002F_sections.md",{"type":48,"value":754}," for the full index with CWE\u002FOWASP references.",{"type":42,"tag":57,"props":756,"children":758},{"id":757},"quick-reference",[759],{"type":48,"value":760},"Quick Reference",{"type":42,"tag":137,"props":762,"children":763},{},[764,780],{"type":42,"tag":141,"props":765,"children":766},{},[767],{"type":42,"tag":145,"props":768,"children":769},{},[770,775],{"type":42,"tag":149,"props":771,"children":772},{},[773],{"type":48,"value":774},"Vulnerability",{"type":42,"tag":149,"props":776,"children":777},{},[778],{"type":48,"value":779},"Key Prevention",{"type":42,"tag":160,"props":781,"children":782},{},[783,795,807,819,831,843,856],{"type":42,"tag":145,"props":784,"children":785},{},[786,790],{"type":42,"tag":167,"props":787,"children":788},{},[789],{"type":48,"value":315},{"type":42,"tag":167,"props":791,"children":792},{},[793],{"type":48,"value":794},"Parameterized queries",{"type":42,"tag":145,"props":796,"children":797},{},[798,802],{"type":42,"tag":167,"props":799,"children":800},{},[801],{"type":48,"value":350},{"type":42,"tag":167,"props":803,"children":804},{},[805],{"type":48,"value":806},"Output encoding",{"type":42,"tag":145,"props":808,"children":809},{},[810,814],{"type":42,"tag":167,"props":811,"children":812},{},[813],{"type":48,"value":333},{"type":42,"tag":167,"props":815,"children":816},{},[817],{"type":48,"value":818},"Avoid shell, use APIs",{"type":42,"tag":145,"props":820,"children":821},{},[822,826],{"type":42,"tag":167,"props":823,"children":824},{},[825],{"type":48,"value":384},{"type":42,"tag":167,"props":827,"children":828},{},[829],{"type":48,"value":830},"Validate paths",{"type":42,"tag":145,"props":832,"children":833},{},[834,838],{"type":42,"tag":167,"props":835,"children":836},{},[837],{"type":48,"value":512},{"type":42,"tag":167,"props":839,"children":840},{},[841],{"type":48,"value":842},"URL allowlists",{"type":42,"tag":145,"props":844,"children":845},{},[846,851],{"type":42,"tag":167,"props":847,"children":848},{},[849],{"type":48,"value":850},"Secrets",{"type":42,"tag":167,"props":852,"children":853},{},[854],{"type":48,"value":855},"Environment variables",{"type":42,"tag":145,"props":857,"children":858},{},[859,864],{"type":42,"tag":167,"props":860,"children":861},{},[862],{"type":48,"value":863},"Crypto",{"type":42,"tag":167,"props":865,"children":866},{},[867],{"type":48,"value":868},"SHA-256, AES-256",{"items":870,"total":939},[871,877,892,906,925],{"slug":4,"name":4,"fn":5,"description":6,"org":872,"tags":873,"stars":22,"repoUrl":23,"updatedAt":24},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[874,875,876],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":878,"name":878,"fn":879,"description":880,"org":881,"tags":882,"stars":22,"repoUrl":23,"updatedAt":891},"llm-security","apply LLM security guidelines","Security guidelines for LLM applications based on OWASP Top 10 for LLM 2025. Use when building LLM apps, reviewing AI security, implementing RAG systems, or asking about LLM vulnerabilities like 'prompt injection' or 'check LLM security'. IMPORTANT: Always consult this skill when building chatbots, AI agents, RAG pipelines, tool-using LLMs, agentic systems, or any application that calls an LLM API (OpenAI, Anthropic, Gemini, etc.) — even if the user doesn't explicitly mention security. Also use when users import 'openai', 'anthropic', 'langchain', 'llamaindex', or similar LLM libraries.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[883,884,887,890],{"name":17,"slug":18,"type":15},{"name":885,"slug":886,"type":15},"LLM","llm",{"name":888,"slug":889,"type":15},"Risk Assessment","risk-assessment",{"name":13,"slug":14,"type":15},"2026-04-06T18:52:50.687939",{"slug":8,"name":8,"fn":893,"description":894,"org":895,"tags":896,"stars":22,"repoUrl":23,"updatedAt":905},"run Semgrep scans and create rules","Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use this skill when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', 'static analysis', 'lint for security', 'audit this code', or want to enforce coding standards — even if they don't mention Semgrep by name. Semgrep is the right tool for pattern-based code scanning across 30+ languages.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[897,900,901,902],{"name":898,"slug":899,"type":15},"Code Analysis","code-analysis",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":903,"slug":904,"type":15},"Static Analysis","static-analysis","2026-04-06T18:52:49.360762",{"slug":907,"name":907,"fn":908,"description":909,"org":910,"tags":911,"stars":922,"repoUrl":923,"updatedAt":924},"install-mfw","install and configure Semgrep Malware Firewall","Install the mfw (Semgrep Malware Firewall) CLI via the curl|sh installer and walk the user through setup — trust store, PATH shims, shell integration, and the background daemon — asking questions at real decision points. Detects when the user's shell rc files are *managed* (symlinked into nix \u002F home-manager \u002F chezmoi \u002F GNU stow \u002F a dotfiles git repo) and, instead of clobbering them, adds mfw's source line to the right source-of-truth. Use when the user wants to install, set up, or onboard mfw on this machine.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[912,915,918,921],{"name":913,"slug":914,"type":15},"CLI","cli",{"name":916,"slug":917,"type":15},"Deployment","deployment",{"name":919,"slug":920,"type":15},"Onboarding","onboarding",{"name":13,"slug":14,"type":15},9,"https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fguardian","2026-07-21T05:37:19.475723",{"slug":926,"name":926,"fn":927,"description":928,"org":929,"tags":930,"stars":936,"repoUrl":937,"updatedAt":938},"setup-semgrep-plugin","set up the Semgrep plugin","Set up the Semgrep plugin by installing Semgrep, authenticating, and verifying compatibility",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[931,934,935],{"name":932,"slug":933,"type":15},"Local Development","local-development",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},1,"https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fcursor-plugin","2026-04-06T18:52:53.29796",5,{"items":941,"total":962},[942,948,955],{"slug":4,"name":4,"fn":5,"description":6,"org":943,"tags":944,"stars":22,"repoUrl":23,"updatedAt":24},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[945,946,947],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":878,"name":878,"fn":879,"description":880,"org":949,"tags":950,"stars":22,"repoUrl":23,"updatedAt":891},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[951,952,953,954],{"name":17,"slug":18,"type":15},{"name":885,"slug":886,"type":15},{"name":888,"slug":889,"type":15},{"name":13,"slug":14,"type":15},{"slug":8,"name":8,"fn":893,"description":894,"org":956,"tags":957,"stars":22,"repoUrl":23,"updatedAt":905},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[958,959,960,961],{"name":898,"slug":899,"type":15},{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":903,"slug":904,"type":15},3]