这是一套给AI编程助手用的安全技能包，目前还是测试版。它把Semgrep的开源安全规则转成了AI能直接调用的技能格式，主要覆盖OWASP Top 10、基础设施安全和15种以上语言的编码安全最佳实践。你写新代码、审查代码漏洞、问安全编码问题或者配置云环境（比如Terraform、Kubernetes、Docker）时都能用上。核心技能包括SQL注入防护、命令注入防护、跨站脚本防护这些关键安全类别。安装方式就是按照Agent Skills的标准格式来装，把技能包放到AI代理能识别的位置就行。适合开发团队想在日常编码流程里自动加一层安全审查的场景。
查看英文原文
Agent Skills [Beta] A collection of skills for AI coding agents. Skills are packaged instructions and scripts that extend agent capabilities. This should be considered beta level software; it's primarily generated by transforming open source Semgrep rules into skill format. Skills follow the Agent Skills format. Installation [安装/使用命令见下方] Available Skills code security Comprehensive code security guidelines from Semgrep Engineering covering OWASP Top 10, infrastructure security, and secure coding best practices across 15+ languages. Use when: Writing new code Reviewing code for security vulnerabilities Asking about secure coding practices Configuring cloud infrastructure (Terraform, Kubernetes, Docker) Categories covered: Impact Category Description Critical SQL Injection Parameterized queries, ORM safety Critical Command Injection Shell command safety, input validation Critical Cross Site Scripting (XSS) Output encoding, DOM safety Critical XML External Entity (XXE) XML parser configuration Critical Path Traversal File path validation Critical Insecure Deserialization Safe deserialization patterns Critical Code Injection Eval safety, template injection Critical Hardcoded Secrets Environment variables, secret management Critical Memory Safety Buffer overflows, use after free (C/C++) High Insecure Cryptography Strong hashing (SHA 256+), encryption (AES) High Insecure Transport HTTPS, certificate validation, TLS High Server Side Request Forgery URL validation, allowlists High JWT Authentication Signature verification, algorithm safety High Cross Site Request Forgery CSRF tokens, SameSite cookies High Prototype Pollution Object key validation (JavaScript) High Unsafe Functions Dangerous function alternatives High Terraform AWS S3, IAM, EC2, RDS security High Terraform Azure Storage, App Service, Key Vault High Terraform GCP GCS, GCE, GKE, IAM High Kubernetes Pod security, RBAC, secrets High Docker Non root containers, image pinning High GitHub Actions Script injection,