1---2name: code-security3description: Guides secure coding and security-focused code review across languages and infrastructure—OWASP-oriented vulnerability patterns (injection, XSS, auth, crypto, deserialization, SSRF, XXE), secrets handling, and IaC security (Terraform, Kubernetes, Docker, GitHub Actions). Use when writing or reviewing code that handles user input, authentication, files, databases, network requests, cryptography, or infrastructure config—or when the user asks to check for SQL injection, XSS, SSRF, hardcoded secrets, OWASP issues, Terraform security, or GitHub Actions security. Not for authorized penetration test engagements (ai-redteam, cybersecurity), compliance program mapping (compliance-engineer), YARA/malware rules (yara-rule-authoring), or CI pipeline setup only (devsecops).4---56# Code Security78## When to Use910- Write or review application code for common vulnerability classes (injection, XSS, auth, crypto, SSRF, XXE, deserialization)11- Review secrets handling, session/JWT patterns, and transport security in code12- Review Terraform, Kubernetes manifests, Dockerfiles, or GitHub Actions for security misconfigurations13- Proactively harden code that accepts user input, performs I/O, queries databases, or calls external URLs14- Map findings to CWE/OWASP categories and suggest concrete secure patterns1516## When NOT to Use1718- Plan or execute authorized penetration tests, exploit chains, or red-team campaigns → `ai-redteam`, `cybersecurity`, `penetration-tester`, `red-team-specialist`19- Map controls to SOC 2, ISO 27001, or build audit evidence packages → `compliance-engineer`, `compliance-specialist`20- Deploy SIEM, IdP, KMS, WAF, or operate security tooling → `information-security-engineer`21- Configure CI/CD scanners, SBOM, OIDC, or pipeline gates without secure-coding review → `devsecops`22- Author YARA or malware detection rules → `yara-rule-authoring`23- General feature design, RFCs, or refactoring without a security lens → `senior-software-engineer`2425## Related skills2627| Need | Skill |28|---|---|29| Security program strategy, policies, IR | `cybersecurity` |30| Control implementation, IdP, KMS, SIEM | `information-security-engineer` |31| CI/CD security gates, SBOM, pipeline OIDC | `devsecops` |32| Audit evidence and framework mapping | `compliance-engineer` |33| LLM/agent red team and prompt injection | `ai-redteam` |34| Code review, RFCs, reliability (non-security) | `senior-software-engineer` |35| Cloud account guardrails and CSPM | `cloud-security-engineer` |36| Cryptographic primitive/protocol design | `cryptographer-specialist` |37| Pentest findings reproduction | `penetration-tester`, `web-pentester` |3839## How to work4041### Modes4243- **Proactive** — When writing or touching security-sensitive code (input, auth, files, DB, HTTP clients, crypto, IaC), check relevant categories without waiting for an explicit security ask.44- **Reactive** — When the user requests a security review, follow the review workflow in `references/review_checklist_and_owasp_mapping.md`.4546### Workflow47481. Identify language/stack and what the code does (input? DB? shell? XML? outbound HTTP? secrets? IaC?).492. Load the matching reference(s) below; prioritize **Critical** then **High** impact.503. Flag vulnerable patterns with CWE/OWASP labels; propose secure alternatives from references (language-specific examples live there).514. For reviews, produce severity-ordered findings with file/line context and fix guidance.5253### Language priority (first checks)5455| Language / stack | Priority topics |56|---|---|57| Python | SQL/command injection, path traversal, code injection, SSRF, insecure crypto, deserialization |58| JavaScript/TypeScript | XSS, prototype pollution, code injection, CSRF, insecure transport |59| Java | SQL injection, XXE, insecure deserialization, SSRF, insecure crypto |60| Go | SQL/command injection, path traversal, SSRF, insecure transport |61| C/C++ | Memory safety, unsafe functions, command injection, path traversal |62| Ruby / PHP | SQL/command injection, XSS, deserialization (Ruby), code injection |63| HCL / YAML | Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions |6465## When to load references6667Detailed vulnerable/secure patterns and multi-language examples are in `references/` (condensed from 28 upstream rule categories). Do not expect per-language copies of every rule in `SKILL.md`.6869| Topic | Reference |70|---|---|71| Scope, modes, language priorities | `references/code_security_scope_and_workflow.md` |72| SQL, command, XSS, path traversal, code injection | `references/injection_and_input_validation.md` |73| Secrets, JWT, CSRF, crypto, TLS | `references/crypto_auth_and_session.md` |74| XXE, deserialization, SSRF | `references/deserialization_ssrf_xxe.md` |75| Terraform, K8s, Docker, GitHub Actions | `references/infrastructure_as_code_security.md` |76| Review checklist, CWE/OWASP map, medium/low | `references/review_checklist_and_owasp_mapping.md` |7778## Quick prevention reference7980| Vulnerability | Key prevention |81|---|---|82| SQL injection | Parameterized queries / prepared statements |83| XSS | Context-aware output encoding; CSP where appropriate |84| Command injection | Avoid shell; use APIs with argument lists |85| Path traversal | Canonicalize paths; allowlist base directories |86| SSRF | URL allowlists; block metadata/link-local ranges |87| Secrets | Env vars / secret managers; never commit credentials |88| Weak crypto | SHA-256+, AES-256-GCM; avoid MD5/SHA1/DES/ECB |89| XXE | Disable DTD/external entities in XML parsers |90| Deserialization | Do not deserialize untrusted data |
daemon-blockint-tech