67476ea59b
Same skills in .agents/skills (Codex) and .claude/skills (Claude Code): codeguard, security-review, dependency-vetting, pre-release-gate, authz-idor-audit, threat-model-light. Source: cj/claude-skills. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
98 lines
8.5 KiB
Markdown
98 lines
8.5 KiB
Markdown
---
|
|
name: codeguard
|
|
description: A CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed.
|
|
codeguard-version: "1.5.0"
|
|
framework: "Project CodeGuard"
|
|
purpose: "Embed secure-by-default practices into AI coding workflows"
|
|
---
|
|
|
|
# CodeGuard Skill
|
|
This skill provides comprehensive security guidance to help AI coding agents generate secure code and prevent common vulnerabilities. It is based on **Project CodeGuard**, an open-source, model-agnostic security framework that embeds secure-by-default practices into AI coding workflows.
|
|
|
|
## When to Use This Skill
|
|
This skill should be activated when:
|
|
- Writing new code in any language
|
|
- Reviewing or modifying existing code
|
|
- Implementing security-sensitive features (authentication, cryptography, data handling, etc.)
|
|
- Working with user input, databases, APIs, or external services
|
|
- Configuring cloud infrastructure, CI/CD pipelines, or containers
|
|
- Handling sensitive data, credentials, or cryptographic operations
|
|
|
|
## How to Use This Skill
|
|
When writing or reviewing code:
|
|
1. Always-Apply Rules: Some rules MUST be checked on every code operation:
|
|
- `codeguard-1-hardcoded-credentials.md` - Never hardcode secrets, passwords, API keys, or tokens
|
|
- `codeguard-1-crypto-algorithms.md` - Use only modern, secure cryptographic algorithms
|
|
- `codeguard-1-digital-certificates.md` - Validate and manage digital certificates securely
|
|
2. Tag-Based Rules: When you identify any of these security contexts in the code, apply ALL rules with the matching tag:
|
|
|
|
|
|
| Security Context (Tag) | Rule Files to Apply |
|
|
|------------------------|---------------------|
|
|
| authentication | codeguard-0-authentication-mfa.md, codeguard-0-session-management-and-cookies.md |
|
|
| data-security | codeguard-0-additional-cryptography.md, codeguard-0-data-storage.md |
|
|
| infrastructure | codeguard-0-cloud-orchestration-kubernetes.md, codeguard-0-data-storage.md, codeguard-0-devops-ci-cd-containers.md, codeguard-0-iac-security.md |
|
|
| privacy | codeguard-0-logging.md, codeguard-0-privacy-data-protection.md |
|
|
| secrets | codeguard-0-additional-cryptography.md, codeguard-1-digital-certificates.md, codeguard-1-hardcoded-credentials.md |
|
|
| web | codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-client-side-web-security.md, codeguard-0-input-validation-injection.md, codeguard-0-session-management-and-cookies.md |
|
|
|
|
|
|
3. Language-Specific Rules: Apply rules from /rules directory based on the programming language of the feature being implemented using the table given below:
|
|
|
|
|
|
| Language | Rule Files to Apply |
|
|
|----------|---------------------|
|
|
| apex | codeguard-0-input-validation-injection.md |
|
|
| c | codeguard-0-additional-cryptography.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-data-storage.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-input-validation-injection.md, codeguard-0-logging.md, codeguard-0-safe-c-functions.md, codeguard-0-xml-and-serialization.md |
|
|
| cpp | codeguard-0-safe-c-functions.md |
|
|
| docker | codeguard-0-devops-ci-cd-containers.md, codeguard-0-supply-chain-security.md |
|
|
| go | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md |
|
|
| hcl | codeguard-0-iac-security.md |
|
|
| html | codeguard-0-client-side-web-security.md, codeguard-0-input-validation-injection.md |
|
|
| java | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-mobile-apps.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md |
|
|
| javascript | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-client-side-web-security.md, codeguard-0-data-storage.md, codeguard-0-devops-ci-cd-containers.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-logging.md, codeguard-0-mcp-security.md, codeguard-0-mobile-apps.md, codeguard-0-privacy-data-protection.md, codeguard-0-session-management-and-cookies.md, codeguard-0-supply-chain-security.md |
|
|
| kotlin | codeguard-0-additional-cryptography.md, codeguard-0-authentication-mfa.md, codeguard-0-framework-and-languages.md, codeguard-0-mobile-apps.md |
|
|
| php | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-client-side-web-security.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md |
|
|
| powershell | codeguard-0-devops-ci-cd-containers.md, codeguard-0-iac-security.md, codeguard-0-input-validation-injection.md |
|
|
| python | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md |
|
|
| ruby | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-session-management-and-cookies.md, codeguard-0-xml-and-serialization.md |
|
|
| rust | codeguard-0-mcp-security.md |
|
|
| shell | codeguard-0-devops-ci-cd-containers.md, codeguard-0-iac-security.md, codeguard-0-input-validation-injection.md |
|
|
| sql | codeguard-0-data-storage.md, codeguard-0-input-validation-injection.md |
|
|
| swift | codeguard-0-additional-cryptography.md, codeguard-0-authentication-mfa.md, codeguard-0-mobile-apps.md |
|
|
| typescript | codeguard-0-additional-cryptography.md, codeguard-0-api-web-services.md, codeguard-0-authentication-mfa.md, codeguard-0-authorization-access-control.md, codeguard-0-client-side-web-security.md, codeguard-0-file-handling-and-uploads.md, codeguard-0-framework-and-languages.md, codeguard-0-input-validation-injection.md, codeguard-0-mcp-security.md, codeguard-0-session-management-and-cookies.md |
|
|
| xml | codeguard-0-api-web-services.md, codeguard-0-mobile-apps.md, codeguard-0-xml-and-serialization.md |
|
|
| yaml | codeguard-0-authorization-access-control.md, codeguard-0-cloud-orchestration-kubernetes.md, codeguard-0-data-storage.md, codeguard-0-devops-ci-cd-containers.md, codeguard-0-iac-security.md, codeguard-0-supply-chain-security.md |
|
|
|
|
|
|
4. Proactive Security: Don't just avoid vulnerabilities-actively implement secure patterns:
|
|
- Use parameterized queries for database access
|
|
- Validate and sanitize all user input
|
|
- Apply least-privilege principles
|
|
- Use modern cryptographic algorithms and libraries
|
|
- Implement defense-in-depth strategies
|
|
|
|
## CodeGuard Security Rules
|
|
The security rules are available in the `rules/` directory.
|
|
|
|
### Usage Workflow
|
|
When generating or reviewing code, follow this workflow:
|
|
|
|
### 1. Initial Security Check
|
|
Before writing any code:
|
|
- Check: Will this handle credentials? → Apply codeguard-1-hardcoded-credentials
|
|
- Check: What security tags apply? → Load all rules with matching tags (e.g., "authentication", "web", "secrets")
|
|
- Check: What language am I using? → Identify applicable language-specific rules
|
|
|
|
### 2. Code Generation
|
|
While writing code:
|
|
- Apply secure-by-default patterns from relevant Project CodeGuard rules
|
|
- Add security-relevant comments explaining choices
|
|
|
|
### 3. Security Review
|
|
After writing code:
|
|
- Review against implementation checklists in each rule
|
|
- Verify no hardcoded credentials or secrets
|
|
- Validate that all the rules have been successfully followed when applicable.
|
|
- Explain which security rules were applied
|
|
- Highlight security features implemented
|