Agent Native

code-security

This skill provides comprehensive security guidelines for writing secure code across 15+ languages, covering OWASP Top 10 vulnerabilities and infrastructure…

by SemgrepOfficial publisherNot reviewed

Identity proven by GitHub's verified organisation badge (semgrep)

Agents
Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode, claude.ai and API
License
LicenseRef-Semgrep-Rules (restricted)
Pin
68177b8pinned Oct 9, 2026
Context cost
about 1,100 tokenswhen the skill loads
GitHub stars
322on semgrep/skills
Scripts
None found

What it does

“Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'.”
The author's description, from SKILL.md

Generated summary from the skill's own text

This skill provides comprehensive security guidelines for writing secure code across 15+ languages, covering OWASP Top 10 vulnerabilities and infrastructure security. The agent consults 28 rule categories with specific code examples to identify and prevent SQL injection, XSS, command injection, cryptographic weaknesses, and other security flaws during code writing and reviews. It operates proactively by automatically checking for relevant vulnerabilities based on code patterns and language, or reactively when users ask about security.

When to use it

  • Writing code that handles user input, databases, file operations, or authentication
  • Reviewing code for vulnerabilities, bugs, or security issues
  • Building infrastructure with Terraform, Kubernetes, Docker, or GitHub Actions
  • Asking about secure coding practices or vulnerability prevention

When not to

  • Deploying to production without additional security testing or audits
  • Replacing formal security assessments by dedicated tools or specialists

Install

Restricted license: install from the publisher's repository and read its terms.

These commands install from the publisher's repository and need no account.

skills CLI

npx skills add semgrep/skills --skill code-security

Installs from the repository's default branch, which may have changed since the commit we checked.

GitHub CLI 2.90 or later

gh skill install semgrep/skills code-security@68177b8830f96cd9d10dacbb14dde2566360503d

Installs the commit we checked (68177b8).

Copy by hand

Download the folder at 68177b8 and put it in .claude/skills/code-security for Claude Code and in .agents/skills/code-security for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode.

Skill folder on GitHub at 68177b8

Claude Code plugin

/plugin install semgrep@claude-plugins-official

The publisher's plugin in Claude's official marketplace. It may hold more than this skill, and we have not pinned it.

Copy for your agent

A prompt for any coding agent. It installs this skill from GitHub at the pinned commit, copies the files as they are, and runs nothing unless you ask.

Prompt

Install the agent skill "code-security" by Semgrep.

Source, pinned to commit 68177b8830f96cd9d10dacbb14dde2566360503d:
https://github.com/semgrep/skills/tree/68177b8830f96cd9d10dacbb14dde2566360503d/skills/code-security

1. Download that folder at exactly this commit. Do not use the default branch.
2. Copy every file unchanged, keeping the folder structure, into .claude/skills/code-security/ for Claude Code and .agents/skills/code-security/ for Codex, Cursor, Gemini CLI, GitHub Copilot and OpenCode. Create the folders if they do not exist.
3. Do not edit the files, and do not run any script in the folder unless I ask you to.
4. When you are done, list the files you copied and where you put them.

Its license is restricted or not stated. Show me the license terms from the repository before you copy anything.

Listing and checks: https://www.agentnative.dev/skills/semgrep/code-security

SKILL.md at the pin

The license of this skill does not let us show its files here.

View SKILL.md on GitHub at 68177b8

Files

34 files, 268 KB in total. Each file has a sha256 in the pin's manifest; the first 12 characters are shown.

Skill folder on GitHub at 68177b8
All 6 skills from Semgrep

More from Semgrep

  • llm-security

    This skill provides security guidelines for LLM applications based on the OWASP Top 10 for LLM 2025.

    Claude Code, Codex, Cursor +4 · about 1.1K tokens · pinned 6 days ago

  • semgrep

    This skill enables the agent to run Semgrep static analysis scans for security vulnerabilities and create custom detection rules in YAML.

    Claude Code, Codex, Cursor +4 · about 2.2K tokens · pinned 6 days ago

  • add-and-validate-guardian-developer-semgrep-rule

    This skill helps developers write custom Semgrep rules and add them to Guardian to enforce project conventions or catch patterns Guardian's standard rules miss.

    Claude Code · about 2.1K tokens · pinned 6 days ago

  • remove-guardian-developer-semgrep-rule

    This skill removes custom Semgrep rules that Guardian maintains in user or repository directories.

    Claude Code · about 940 tokens · pinned 6 days ago

  • setup-semgrep-plugin

    This skill installs and configures Semgrep on the agent's system, including authentication with Semgrep's service and verification that version 1.146.0 or…

    Claude Code, Codex, Cursor +4 · about 190 tokens · pinned 6 days ago

All Security skills

Related in Security

  • container-security

    This skill scans Docker container images for OS package vulnerabilities, application dependencies, and Dockerfile configuration issues using Snyk.

    by SnykOfficial publisher

    Claude Code, Codex, Cursor +4 · about 2.2K tokens · pinned 6 days ago

  • iac-security

    This skill scans Infrastructure as Code files for security misconfigurations across Terraform, Kubernetes, CloudFormation, and Azure ARM templates using Snyk.

    by SnykOfficial publisher

    Claude Code, Codex, Cursor +4 · about 2.1K tokens · pinned 6 days ago

  • claude-security

    Scans your repository for security issues using Claude, examines code changes or commits for vulnerabilities, and generates patch files to fix findings.

    by AnthropicOfficial publisher

    Claude Code · about 1K tokens · pinned 6 days ago

  • sensitive-logging-audit

    The skill helps audit and fix sensitive data leaks in Python SDK logging, exceptions, and telemetry by collecting candidate sinks, manually tracing values…

    by OpenAIOfficial publisher

    Contains scripts

    Claude Code, Codex, Cursor +3 · about 970 tokens · pinned 6 days ago

  • security-audit

    This skill guides security audits of codebases, APIs, and services by finding vulnerabilities that cross real trust boundaries.

    by CloudflareOfficial publisher

    Contains scripts

    Claude Code · about 5.4K tokens · pinned 6 days ago

  • assess-patch-risk

    This skill analyzes patch artifacts to assess their program impact, regression risk, and suitability for automated merging.

    by OpenAIOfficial publisher

    Codex · about 2.3K tokens · pinned 6 days ago

The skills listed here are third-party software, collected from public GitHub repositories as a catalog of recent skills and provided as is. Agent Native does not write or control them and is not responsible for any harm, loss or damage caused by installing or using them. Labels and checks describe what we saw at one commit and are not a guarantee. Read a skill's files before you run it. Terms of use