Install
$ npx skills add semgrep/skillsNo CLI or API key needed — this skill is guidance only.
Best for
Secure-code review with real depth behind each finding: the skill ships separate references for SQL injection, XSS, SSRF, XXE, CSRF, secrets, regex DoS, memory safety, Docker, Kubernetes, and Terraform on AWS and GCP.
Not ideal for
Running an actual scan — this is guidance, not a scanner. Pair it with the semgrep skill when you need findings rather than review standards.
About this skill
Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security.
Score breakdown
Score breakdown
rubric 1.0Composite 0–100 score derived from 9 verifiable signals. See the rubric →
Related skills
Security audits run by a real security firm. CodeQL + Semgrep + audit workflows.
Kubernetes hardening by the book. NetworkPolicies, RBAC, OPA, service mesh.
Real exploits, no false positives. 96.15% exploit success across 50+ vuln types.
