How do I install the Defect Taxonomy skill?

Run npx skillmds@latest add acaprino/defect-taxonomy in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Defect Taxonomy safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Defect Taxonomy?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Defect Taxonomy free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Defect Taxonomy?

acaprino (@acaprino) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Defect Taxonomy by acaprino — Agent Skill

Name: Defect Taxonomy
Author: acaprino

Defect Taxonomy

16 macro-categories and 140+ subcategories of source-code failure modes, with CWE and OWASP mappings, fix patterns, and review frameworks. TRIGGER WHEN: an audit needs structured defect classification, a detection strategy, or severity calibration; loaded by code-auditor, security-auditor, and ui-race-auditor.

acaprino 4976b2f 10 files · 100.2 KB Updated Sep 17, 2026

File contents

Defect Taxonomy Knowledge Base

Unified classification of source code defects synthesizing MITRE CWE, OWASP Top 10, NASA Power of 10, IBM ODC, IEEE 1044, and Beizer's taxonomy into actionable detection references.

Reference Files

Load relevant references based on the code domain under review. Do NOT load all files -- select only what applies.

Taxonomy References (defect patterns)

Reference	When to load
`references/concurrency-state.md`	Concurrent/parallel code, shared state, async patterns, closures, variable scoping
`references/logic-types.md`	Comparisons, boolean logic, type conversions, generics, serialization
`references/memory-resources.md`	Memory management (C/C++/Rust), resource lifecycle, error handling, performance bottlenecks
`references/security.md`	Security review -- injection, auth, crypto, secrets, CORS, SSRF, input validation
`references/distributed-integration.md`	Microservices, APIs, distributed state, message queues, service mesh, migrations
`references/data-design-ops.md`	Database/ORM, design patterns, build/deploy, testing, observability
`references/detection-matrix.md`	Cross-cutting: detection channels per category, language-weighted focus, ROI prioritization

Review Frameworks (analysis methodology)

Reference	When to load
`references/review-frameworks.md`	Always load for code-auditor. Contains cognitive models, failure flow methodology, anti-pattern checklist, mental models, severity/scoring system

Language-Weighted Category Focus

C/C++: concurrency-state.md + memory-resources.md (categories 1, 5)
JVM (Java/Kotlin/Scala): concurrency-state.md + logic-types.md + memory-resources.md (categories 2, 7, 8)
JavaScript/TypeScript: concurrency-state.md + logic-types.md + security.md (categories 2, 4, 6)
Python: logic-types.md + security.md + memory-resources.md (categories 4, 6, 7)
Go/Rust: concurrency-state.md + memory-resources.md (categories 1, 5, 7)
Microservices (any): distributed-integration.md + data-design-ops.md (categories 8-12)

Usage Instructions

Identify the language(s) and domain of the code under review
Load the review-frameworks.md reference (for code-auditor agent)
Load 1-3 taxonomy references matching the language/domain
Apply detection strategies from the loaded references during analysis
Map findings to CWE identifiers where applicable
Use the detection-matrix.md to prioritize detection approach

---name: defect-taxonomydescription: 16 macro-categories and 140+ subcategories of source-code failure modes, with CWE and OWASP mappings, fix patterns, and review frameworks. TRIGGER WHEN: an audit needs structured defect classification, a detection strategy, or severity calibration; loaded by code-auditor, security-auditor, and ui-race-auditor.---# Defect Taxonomy Knowledge BaseUnified classification of source code defects synthesizing MITRE CWE, OWASP Top 10, NASA Power of 10, IBM ODC, IEEE 1044, and Beizer's taxonomy into actionable detection references.## Reference FilesLoad relevant references based on the code domain under review. Do NOT load all files -- select only what applies.### Taxonomy References (defect patterns)| Reference | When to load ||-----------|-------------|| `references/concurrency-state.md` | Concurrent/parallel code, shared state, async patterns, closures, variable scoping || `references/logic-types.md` | Comparisons, boolean logic, type conversions, generics, serialization || `references/memory-resources.md` | Memory management (C/C++/Rust), resource lifecycle, error handling, performance bottlenecks || `references/security.md` | Security review -- injection, auth, crypto, secrets, CORS, SSRF, input validation || `references/distributed-integration.md` | Microservices, APIs, distributed state, message queues, service mesh, migrations || `references/data-design-ops.md` | Database/ORM, design patterns, build/deploy, testing, observability || `references/detection-matrix.md` | Cross-cutting: detection channels per category, language-weighted focus, ROI prioritization |### Review Frameworks (analysis methodology)| Reference | When to load ||-----------|-------------|| `references/review-frameworks.md` | Always load for code-auditor. Contains cognitive models, failure flow methodology, anti-pattern checklist, mental models, severity/scoring system |## Language-Weighted Category Focus- **C/C++**: concurrency-state.md + memory-resources.md (categories 1, 5)- **JVM (Java/Kotlin/Scala)**: concurrency-state.md + logic-types.md + memory-resources.md (categories 2, 7, 8)- **JavaScript/TypeScript**: concurrency-state.md + logic-types.md + security.md (categories 2, 4, 6)- **Python**: logic-types.md + security.md + memory-resources.md (categories 4, 6, 7)- **Go/Rust**: concurrency-state.md + memory-resources.md (categories 1, 5, 7)- **Microservices (any)**: distributed-integration.md + data-design-ops.md (categories 8-12)## Usage Instructions1. Identify the language(s) and domain of the code under review2. Load the review-frameworks.md reference (for code-auditor agent)3. Load 1-3 taxonomy references matching the language/domain4. Apply detection strategies from the loaded references during analysis5. Map findings to CWE identifiers where applicable6. Use the detection-matrix.md to prioritize detection approach

Frequently asked questions