# Code Security

> |

- **Type:** Skill
- **Install:** `agentstack add skill-daemon-blockint-tech-agentic-enteprises-skill-code-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [daemon-blockint-tech](https://agentstack.voostack.com/s/daemon-blockint-tech)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [daemon-blockint-tech](https://github.com/daemon-blockint-tech)
- **Source:** https://github.com/daemon-blockint-tech/Agentic-Enteprises-Skill/tree/main/code-security

## Install

```sh
agentstack add skill-daemon-blockint-tech-agentic-enteprises-skill-code-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Security

## When to Use

- Write or review application code for common vulnerability classes (injection, XSS, auth, crypto, SSRF, XXE, deserialization)
- Review secrets handling, session/JWT patterns, and transport security in code
- Review Terraform, Kubernetes manifests, Dockerfiles, or GitHub Actions for security misconfigurations
- Proactively harden code that accepts user input, performs I/O, queries databases, or calls external URLs
- Map findings to CWE/OWASP categories and suggest concrete secure patterns

## When NOT to Use

- Plan or execute authorized penetration tests, exploit chains, or red-team campaigns → `ai-redteam`, `cybersecurity`, `penetration-tester`, `red-team-specialist`
- Map controls to SOC 2, ISO 27001, or build audit evidence packages → `compliance-engineer`, `compliance-specialist`
- Deploy SIEM, IdP, KMS, WAF, or operate security tooling → `information-security-engineer`
- Configure CI/CD scanners, SBOM, OIDC, or pipeline gates without secure-coding review → `devsecops`
- Author YARA or malware detection rules → `yara-rule-authoring`
- General feature design, RFCs, or refactoring without a security lens → `senior-software-engineer`

## Related skills

| Need | Skill |
|---|---|
| Security program strategy, policies, IR | `cybersecurity` |
| Control implementation, IdP, KMS, SIEM | `information-security-engineer` |
| CI/CD security gates, SBOM, pipeline OIDC | `devsecops` |
| Audit evidence and framework mapping | `compliance-engineer` |
| LLM/agent red team and prompt injection | `ai-redteam` |
| Code review, RFCs, reliability (non-security) | `senior-software-engineer` |
| Cloud account guardrails and CSPM | `cloud-security-engineer` |
| Cryptographic primitive/protocol design | `cryptographer-specialist` |
| Pentest findings reproduction | `penetration-tester`, `web-pentester` |

## How to work

### Modes

- **Proactive** — When writing or touching security-sensitive code (input, auth, files, DB, HTTP clients, crypto, IaC), check relevant categories without waiting for an explicit security ask.
- **Reactive** — When the user requests a security review, follow the review workflow in `references/review_checklist_and_owasp_mapping.md`.

### Workflow

1. Identify language/stack and what the code does (input? DB? shell? XML? outbound HTTP? secrets? IaC?).
2. Load the matching reference(s) below; prioritize **Critical** then **High** impact.
3. Flag vulnerable patterns with CWE/OWASP labels; propose secure alternatives from references (language-specific examples live there).
4. For reviews, produce severity-ordered findings with file/line context and fix guidance.

### Language priority (first checks)

| Language / stack | Priority topics |
|---|---|
| Python | SQL/command injection, path traversal, code injection, SSRF, insecure crypto, deserialization |
| JavaScript/TypeScript | XSS, prototype pollution, code injection, CSRF, insecure transport |
| Java | SQL injection, XXE, insecure deserialization, SSRF, insecure crypto |
| Go | SQL/command injection, path traversal, SSRF, insecure transport |
| C/C++ | Memory safety, unsafe functions, command injection, path traversal |
| Ruby / PHP | SQL/command injection, XSS, deserialization (Ruby), code injection |
| HCL / YAML | Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions |

## When to load references

Detailed vulnerable/secure patterns and multi-language examples are in `references/` (condensed from 28 upstream rule categories). Do not expect per-language copies of every rule in `SKILL.md`.

| Topic | Reference |
|---|---|
| Scope, modes, language priorities | `references/code_security_scope_and_workflow.md` |
| SQL, command, XSS, path traversal, code injection | `references/injection_and_input_validation.md` |
| Secrets, JWT, CSRF, crypto, TLS | `references/crypto_auth_and_session.md` |
| XXE, deserialization, SSRF | `references/deserialization_ssrf_xxe.md` |
| Terraform, K8s, Docker, GitHub Actions | `references/infrastructure_as_code_security.md` |
| Review checklist, CWE/OWASP map, medium/low | `references/review_checklist_and_owasp_mapping.md` |

## Quick prevention reference

| Vulnerability | Key prevention |
|---|---|
| SQL injection | Parameterized queries / prepared statements |
| XSS | Context-aware output encoding; CSP where appropriate |
| Command injection | Avoid shell; use APIs with argument lists |
| Path traversal | Canonicalize paths; allowlist base directories |
| SSRF | URL allowlists; block metadata/link-local ranges |
| Secrets | Env vars / secret managers; never commit credentials |
| Weak crypto | SHA-256+, AES-256-GCM; avoid MD5/SHA1/DES/ECB |
| XXE | Disable DTD/external entities in XML parsers |
| Deserialization | Do not deserialize untrusted data |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [daemon-blockint-tech](https://github.com/daemon-blockint-tech)
- **Source:** [daemon-blockint-tech/Agentic-Enteprises-Skill](https://github.com/daemon-blockint-tech/Agentic-Enteprises-Skill)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-daemon-blockint-tech-agentic-enteprises-skill-code-security
- Seller: https://agentstack.voostack.com/s/daemon-blockint-tech
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.