Secure Coding Standard Checker

secure-coding-standard-checker

The skill that catches what CodeQL misses — the org-specific layer on top of community queries. Most regulated orgs have a secure-coding standards document; this skill makes the checks reproducible.

When to use

• PR review for code in security-sensitive paths (auth, crypto, customer-data handling).
• Triaging a CodeQL alert that needs the org-specific context (e.g., "is this a legitimate exception to our standard or a real violation?").
• Refactoring legacy code against the current standards.
• Pre-deployment check for security-sensitive modules.

When NOT to use

• Generic code-quality review → CodeQL security-and-quality suite.
• Vulnerability-class scanning → CodeQL security-extended suite + codeql-pattern-finder for custom patterns.
• Workflow security → actions-workflow-hardener.

Check categories

1. Deprecated internal APIs

(This list is illustrative; the actual org's deprecated-API set is maintained as a separate config file the skill loads.)

2. Hard-coded business rules

3. Regulatory pattern violations

4. Bank conventions for security-sensitive components

5. Crypto primitives + key lifetimes

Workflow

1. Identify the code snippet (file path + range, or pasted snippet).
2. Walk each check category against the snippet.
3. Cite the internal standard section per finding (numbered citations to the org's actual secure-coding standard document).
4. Produce findings with severity + remediation + standard reference — presented in chat.
5. Persist the check — after presenting findings, write the full findings note via vault-writer.write_research to vault/research/appsec/YYYY-MM-DD-secure-coding-check-{file-or-module-slug}.md (frontmatter per research.yml, topic: appsec) so recurring violations across checks become queryable trend data.

Output structure

# Secure Coding Check — {file or snippet}

## Summary
- Findings: {N}
- By severity: ...

## Findings
[per finding: rule, severity, line, snippet, standard reference, remediation]

## Sources
{linked vault notes, standard sections}

Lands at vault/research/appsec/YYYY-MM-DD-secure-coding-check-{file-or-module-slug}.md (workflow step 5).

Composes with

• codeql-pattern-finder — when a check would benefit from being encoded as a CodeQL query for at-scan-time enforcement.
• secure-design-reviewer — at the design level rather than implementation.
• vault-writer.write_research — persists the findings note (workflow step 5).

Acceptance test (for step 27 done-criteria)

5 categories documented with ≥20 named checks (the actual org standard will have hundreds; this is the categorization + sample). Live exercise against a specific snippet deferred to first invocation.