Menu
Secure coding patterns and security scanning tools.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Search, read, and send emails via Apple Mail IPC. No TCC issues.
Structured code review with SOLID, security, and quality checks.
Systematic root cause analysis — find the cause before fixing.
Fetch version-specific documentation and code examples.
Orchestrate research, planning, implementation, and verification.
Advanced history manipulation, recovery, and diagnostics.
| name | security |
| description | Secure coding patterns and security scanning tools. |
Two modes: proactive (check while writing/reviewing) and reactive (scan on demand).
| Vulnerability | Prevention |
|---|---|
| SQL Injection | Parameterized queries, never concat |
| XSS | Output encoding, CSP headers |
| Command Injection | Avoid shell, use language APIs |
| Path Traversal | Validate and sanitize file paths |
| SSRF | URL allowlists, no raw user URLs |
| Hardcoded Secrets | Env vars or secret managers only |
| Insecure Crypto | SHA-256+, AES-256, no MD5/DES |
| Insecure Transport | HTTPS everywhere, verify certs |
| XXE | Disable external entities in XML |
| CSRF | Tokens on state-changing requests |
| Language | Check First |
|---|---|
| Python | SQL injection, command injection, path traversal |
| JS/TS | XSS, prototype pollution, code injection |
| Rust | Memory safety, unsafe blocks, command injection |
| Go | SQL injection, command injection, path traversal |
npm audit # Node.js
npm audit fix # Auto-fix
bun pm audit # Bun
cargo audit # Rust
pip-audit # Python
govulncheck ./... # Go
# Gitleaks
gitleaks detect --source . --report-path report.json
# TruffleHog
trufflehog filesystem ./
# Quick ripgrep scan
rg -i "AKIA[0-9A-Z]{16}" . # AWS keys
rg "ghp_[a-zA-Z0-9]{36}" . # GitHub tokens
rg "xox[pbar]-[a-zA-Z0-9-]{14,255}" . # Slack tokens
rg -i "api[_-]?key['\"]?\s*[:=]" . # API keys
rg -i "(mongo|mysql|postgres|redis)://[^ ]+:[^ ]+@" . # DB URLs
# Semgrep (multi-language)
semgrep scan --config auto
semgrep scan --config p/security
semgrep scan --json --output report.json
# Bandit (Python)
bandit -r . -f json -o report.json
# CodeQL
codeql database create db --language=javascript
codeql database analyze db --format=sarif-latest --output results.sarif
# Container scanning
trivy image python:3.11
grype node:18
# Terraform
tfsec . --format json --out report.json
# Kubernetes
kube-score score manifests/*.yaml
checkov -d k8s/
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'
Referrer-Policy: no-referrer
# Check headers
curl -I https://example.com | grep -i "x-\|strict-\|content-\|referrer"
# GitHub Actions security scan
- run: npm audit
- uses: trufflesecurity/trufflehog@main
- uses: returntocorp/semgrep-action@v1
with:
config: auto