---
name: code-security
slug: semgrep-code-security
score: 52
rubric: 1.0
provenance: verified-org
publisher: Semgrep
license: Semgrep Rules License v1.0
capability: read-only
canonical: https://top-agent-skills.com/skill/semgrep-code-security
---

# code-security

A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration.

## Install

### Claude Code

```bash
npx skills add semgrep/skills
```

## Best for

Secure-code review with real depth behind each finding: the skill ships separate references for SQL injection, XSS, SSRF, XXE, CSRF, secrets, regex DoS, memory safety, Docker, Kubernetes, and Terraform on AWS and GCP.

## Not ideal for

Running an actual scan — this is guidance, not a scanner. Pair it with the semgrep skill when you need findings rather than review standards.

## About

Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security.

## Compatibility

claude-code

## Metadata

- Categories: security-auditing, code-quality-review
- Surfaces: claude-code
- Tags: Secure coding, OWASP, Code review
- Setup time: 1 min
- Complexity: Low
- Last update: 2026-07-28
- Verified: —
- Source: https://github.com/semgrep/skills/tree/main/skills/code-security
- Docs: https://github.com/semgrep/skills/blob/main/skills/code-security/SKILL.md

---

_Indexed by Top Agent Skills. Score breakdown: https://top-agent-skills.com/about/methodology_