How do I install the Secure Code skill?

Run npx skillmds@latest add davisbuilds/secure-code in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Secure Code safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Secure Code?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Secure Code free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Secure Code?

davisbuilds (@davisbuilds) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Secure Code by davisbuilds — Agent Skill

Name: Secure Code
Author: davisbuilds

Secure Code

Static analysis security scanning and architectural trifecta detection using semgrep. Use when reviewing code for security vulnerabilities, running SAST scans, checking for the lethal trifecta (private data + untrusted input + external comms co-occurrence), or when the user says 'scan', 'security scan', 'trifecta check', 'check for vulnerabilities', 'SAST', or 'secure this code'. On-demand via /scan and /trifecta-check commands.

davisbuilds 7890a2e 13 files · 35.6 KB Updated Sep 17, 2026

File contents

secure-code

Overview

Integrate semgrep as a deterministic SAST oracle into the agent workflow. Two capabilities:

Security scanning (/scan): Run semgrep on target files, parse findings into severity-grouped markdown.
Trifecta detection (/trifecta-check): Detect architectural anti-patterns where private data access, untrusted input processing, and external communication co-occur in a single file.

When To Use

Use this skill when:

reviewing code for security vulnerabilities
running deterministic SAST scans
checking lethal trifecta co-occurrence in architecture
the user asks for /scan or /trifecta-check

Principles

Conservative posture: Present findings with context. Do not auto-fix security issues without explicit user approval.
Deterministic first: semgrep provides ground truth. LLM analysis supplements but never overrides tool output.
Minimal context: Load references only when remediating specific vulnerability classes.

Boundaries

Do not claim vulnerabilities are fixed without rerunning validation.
Do not auto-apply security patches without explicit user approval.
Do not treat LLM reasoning as higher authority than semgrep output.

Setup

Run setup before first use:

bash <skill-dir>/scripts/setup.sh

Scan Workflow

Run semgrep on target files:

bash <skill-dir>/scripts/scan.sh <targets> | python3 <skill-dir>/scripts/parse_findings.py

Present findings grouped by severity: CRITICAL > HIGH > MEDIUM > LOW.
For each finding, include: rule ID, CWE (if tagged), file:line, message, severity.
If remediating, load references/secure-coding-guidelines.md for the relevant vulnerability class.
Propose fixes only with user approval. Never silently patch security issues.

Trifecta Audit Workflow

Run trifecta detection:

python3 <skill-dir>/scripts/trifecta_audit.py <targets>

For flagged files, explain which three legs are present and where.
Load references/lethal-trifecta.md for separation guidance.
Recommend architectural refactoring to isolate legs into separate modules.

Output Requirements

Report findings with:

severity grouping (CRITICAL > HIGH > MEDIUM > LOW)
rule ID/CWE (when present), file:line, and message
minimal remediation direction and whether merge should be blocked

Custom Rules

Project-specific semgrep rules live in rules/. Run them with:

bash <skill-dir>/scripts/scan.sh <targets> --config <skill-dir>/rules/

See references/writing-custom-rules.md for authoring guidance.

Severity Handling

Severity	Action
CRITICAL	Flag immediately. Block merge recommendation.
HIGH	Flag prominently. Recommend fix before merge.
MEDIUM	Report with context. Fix recommended but not blocking.
LOW	Report in summary. Informational.

Network

semgrep rule downloads require network access on first run. After initial fetch, rules are cached locally. Use --metrics=off and --disable-version-check to minimize network calls.

Sibling skills

Two security skills, distinguished by scope.

repo-hardening — broader posture audit (supply-chain, CI/CD, GitHub Actions pinning, branch protection). Pair on high-stakes audits; this skill is the application-code half.
audit-skill — security audit specifically for agent skills. Different artifact; use it before installing third-party skills.

---name: secure-codedescription: Static analysis security scanning and architectural trifecta detection using semgrep. Use when reviewing code for security vulnerabilities, running SAST scans, checking for the lethal trifecta (private data + untrusted input + external comms co-occurrence), or when the user says 'scan', 'security scan', 'trifecta check', 'check for vulnerabilities', 'SAST', or 'secure this code'. On-demand via /scan and /trifecta-check commands.---# secure-code## OverviewIntegrate semgrep as a deterministic SAST oracle into the agent workflow. Two capabilities:1. **Security scanning** (`/scan`): Run semgrep on target files, parse findings into severity-grouped markdown.2. **Trifecta detection** (`/trifecta-check`): Detect architectural anti-patterns where private data access, untrusted input processing, and external communication co-occur in a single file.## When To UseUse this skill when:- reviewing code for security vulnerabilities- running deterministic SAST scans- checking lethal trifecta co-occurrence in architecture- the user asks for `/scan` or `/trifecta-check`## Principles- **Conservative posture**: Present findings with context. Do not auto-fix security issues without explicit user approval.- **Deterministic first**: semgrep provides ground truth. LLM analysis supplements but never overrides tool output.- **Minimal context**: Load references only when remediating specific vulnerability classes.## Boundaries- Do not claim vulnerabilities are fixed without rerunning validation.- Do not auto-apply security patches without explicit user approval.- Do not treat LLM reasoning as higher authority than semgrep output.## SetupRun setup before first use:```bashbash <skill-dir>/scripts/setup.sh```## Scan Workflow1. Run semgrep on target files:```bashbash <skill-dir>/scripts/scan.sh <targets> | python3 <skill-dir>/scripts/parse_findings.py```2. Present findings grouped by severity: CRITICAL > HIGH > MEDIUM > LOW.3. For each finding, include: rule ID, CWE (if tagged), file:line, message, severity.4. If remediating, load `references/secure-coding-guidelines.md` for the relevant vulnerability class.5. Propose fixes only with user approval. Never silently patch security issues.## Trifecta Audit Workflow1. Run trifecta detection:```bashpython3 <skill-dir>/scripts/trifecta_audit.py <targets>```2. For flagged files, explain which three legs are present and where.3. Load `references/lethal-trifecta.md` for separation guidance.4. Recommend architectural refactoring to isolate legs into separate modules.## Output RequirementsReport findings with:- severity grouping (CRITICAL > HIGH > MEDIUM > LOW)- rule ID/CWE (when present), file:line, and message- minimal remediation direction and whether merge should be blocked## Custom RulesProject-specific semgrep rules live in `rules/`. Run them with:```bashbash <skill-dir>/scripts/scan.sh <targets> --config <skill-dir>/rules/```See `references/writing-custom-rules.md` for authoring guidance.## Severity Handling| Severity | Action ||----------|--------|| CRITICAL | Flag immediately. Block merge recommendation. || HIGH | Flag prominently. Recommend fix before merge. || MEDIUM | Report with context. Fix recommended but not blocking. || LOW | Report in summary. Informational. |## Networksemgrep rule downloads require network access on first run. After initial fetch, rules are cached locally. Use `--metrics=off` and `--disable-version-check` to minimize network calls.## Sibling skillsTwo security skills, distinguished by *scope*.- `repo-hardening` — broader posture audit (supply-chain, CI/CD, GitHub Actions pinning, branch protection). Pair on high-stakes audits; this skill is the application-code half.- `audit-skill` — security audit specifically for *agent skills*. Different artifact; use it before installing third-party skills.

Frequently asked questions