code-security by semgrep/skills
npx skills add https://github.com/semgrep/skills --skill code-security涵盖 15 种以上语言的综合安全编码规则。包含 OWASP Top 10、基础设施安全以及 28 个规则类别的编码最佳实践。
主动模式 — 在编写或审查代码时,根据存在的语言和模式自动检查相关漏洞。您无需等待用户询问安全问题。
响应模式 — 当用户询问安全问题时,使用下面的类别查找相关规则文件,然后阅读它以获取详细的易受攻击/安全代码示例。
rules/ 目录中读取特定的规则文件,获取该语言的详细代码示例使用以下语言编写代码时,请首先检查这些规则:
| 语言 | 需检查的优先级规则 |
|---|---|
| Python | SQL 注入、命令注入、路径遍历、代码注入、SSRF、不安全加密 |
| JavaScript/TypeScript | XSS、原型污染、代码注入、不安全传输、CSRF |
| Java | SQL 注入、XXE、不安全反序列化、不安全加密、SSRF |
| Go | SQL 注入、命令注入、路径遍历、不安全传输 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| C/C++ | 内存安全、不安全函数、命令注入、路径遍历 |
| Ruby | SQL 注入、命令注入、代码注入、不安全反序列化 |
| PHP | SQL 注入、XSS、命令注入、代码注入、路径遍历 |
| HCL/YAML | Terraform (AWS/Azure/GCP)、Kubernetes、Docker、GitHub Actions |
rules/sql-injection.md) - 使用参数化查询,切勿拼接用户输入rules/command-injection.md) - 避免使用包含用户输入的 shell 命令,使用安全的 APIrules/xss.md) - 对输出进行转义,利用框架的防护功能rules/xxe.md) - 在 XML 解析器中禁用外部实体rules/path-traversal.md) - 验证并清理文件路径rules/insecure-deserialization.md) - 切勿反序列化不可信数据rules/code-injection.md) - 切勿对用户输入使用 eval()rules/secrets.md) - 使用环境变量或密钥管理器rules/memory-safety.md) - 防止缓冲区溢出、释放后使用 (C/C++)rules/insecure-crypto.md) - 使用 SHA-256+、AES-256,避免 MD5/SHA1/DESrules/insecure-transport.md) - 使用 HTTPS,验证证书rules/ssrf.md) - 验证 URL,使用允许列表rules/authentication-jwt.md) - 始终验证签名rules/csrf.md) - 在状态更改请求上使用 CSRF 令牌rules/prototype-pollution.md) - 在 JavaScript 中验证对象键rules/terraform-aws.md, rules/terraform-azure.md, rules/terraform-gcp.md) - 加密、最小权限、禁止公开访问rules/kubernetes.md) - 不使用特权容器,以非 root 用户运行rules/docker.md) - 不以 root 用户运行,固定镜像版本rules/github-actions.md) - 避免脚本注入,固定 action 版本rules/regex-dos.md) - 避免灾难性回溯rules/race-condition.md) - 使用适当的同步机制rules/correctness.md) - 避免常见逻辑错误rules/best-practice.md) - 通用的安全编码模式完整索引及 CWE/OWASP 参考请参见 rules/_sections.md。
| 漏洞 | 关键预防措施 |
|---|---|
| SQL 注入 | 参数化查询 |
| XSS | 输出编码 |
| 命令注入 | 避免使用 shell,使用 API |
| 路径遍历 | 验证路径 |
| SSRF | URL 允许列表 |
| 密钥 | 环境变量 |
| 加密 | SHA-256, AES-256 |
每周安装量
418
代码仓库
GitHub 星标数
163
首次出现
2026 年 1 月 20 日
安全审计
安装于
opencode370
gemini-cli370
codex369
github-copilot358
amp333
kimi-cli329
Comprehensive security rules for writing secure code across 15+ languages. Covers OWASP Top 10, infrastructure security, and coding best practices with 28 rule categories.
Proactive mode — When writing or reviewing code, automatically check for relevant vulnerabilities based on the language and patterns present. You don't need to wait for the user to ask about security.
Reactive mode — When the user asks about security, use the categories below to find the relevant rule file, then read it for detailed vulnerable/secure code examples.
rules/ for detailed code examples in that languageWhen writing code in these languages, check these rules first:
| Language | Priority Rules to Check |
|---|---|
| Python | SQL injection, command injection, path traversal, code injection, SSRF, insecure crypto |
| JavaScript/TypeScript | XSS, prototype pollution, code injection, insecure transport, CSRF |
| Java | SQL injection, XXE, insecure deserialization, insecure crypto, SSRF |
| Go | SQL injection, command injection, path traversal, insecure transport |
| C/C++ | Memory safety, unsafe functions, command injection, path traversal |
| Ruby | SQL injection, command injection, code injection, insecure deserialization |
| PHP | SQL injection, XSS, command injection, code injection, path traversal |
| HCL/YAML | Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions |
rules/sql-injection.md) - Use parameterized queries, never concatenate user inputrules/command-injection.md) - Avoid shell commands with user input, use safe APIsrules/xss.md) - Escape output, use framework protectionsrules/xxe.md) - Disable external entities in XML parsersrules/path-traversal.md) - Validate and sanitize file pathsrules/insecure-deserialization.md) - Never deserialize untrusted datarules/code-injection.md) - Never eval() user inputrules/insecure-crypto.md) - Use SHA-256+, AES-256, avoid MD5/SHA1/DESrules/insecure-transport.md) - Use HTTPS, verify certificatesrules/ssrf.md) - Validate URLs, use allowlistsrules/authentication-jwt.md) - Always verify signaturesrules/csrf.md) - Use CSRF tokens on state-changing requestsrules/prototype-pollution.md) - Validate object keys in JavaScriptrules/terraform-aws.md, rules/terraform-azure.md, rules/terraform-gcp.md) - Encryption, least privilege, no public accessrules/kubernetes.md) - No privileged containers, run as non-rootrules/docker.md) - Don't run as root, pin image versionsrules/github-actions.md) - Avoid script injection, pin action versionsrules/regex-dos.md) - Avoid catastrophic backtrackingrules/race-condition.md) - Use proper synchronizationrules/correctness.md) - Avoid common logic bugsrules/best-practice.md) - General secure coding patternsSee rules/_sections.md for the full index with CWE/OWASP references.
| Vulnerability | Key Prevention |
|---|---|
| SQL Injection | Parameterized queries |
| XSS | Output encoding |
| Command Injection | Avoid shell, use APIs |
| Path Traversal | Validate paths |
| SSRF | URL allowlists |
| Secrets | Environment variables |
| Crypto | SHA-256, AES-256 |
Weekly Installs
418
Repository
GitHub Stars
163
First Seen
Jan 20, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
opencode370
gemini-cli370
codex369
github-copilot358
amp333
kimi-cli329
React 组合模式指南:Vercel 组件架构最佳实践,提升代码可维护性
106,200 周安装
rules/secrets.md) - Use environment variables or secret managersrules/memory-safety.md) - Prevent buffer overflows, use-after-free (C/C++)