How do I install cosai-oasis-codeguard-security?

Run these in Claude Code: /plugin marketplace add cosai-oasis/project-codeguard then /plugin install codeguard-security@project-codeguard. Then prompt normally.

Does cosai-oasis-codeguard-security auto-invoke its skills?

Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

Is cosai-oasis-codeguard-security free?

Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.

Security

Plugin

cosai-oasis-codeguard-security

This repository is for the work of the Coalition for Secure AI (CoSAI). CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry-leading organizations.

FLOW.md

cosai-oasis@cosai-oasis

GitHub

Plugin Signal69/100Solid

maintained99

capable34

documented80

adopted53

Install on Claude Code

> /plugin marketplace add cosai-oasis/project-codeguard
> /plugin install codeguard-security@project-codeguard

Stats

Python Rust Java Swift C#

+7 tags

C++SQL Kubernetes GitHub Markdown Anthropic MCP

302

Stars

Forks

Active

Maintenance

Python

Language

2d ago

Last commit

6mo ago

Created

Repo: cosai-oasis/project-codeguard

In this plugin

3 skills 1 agent

skills
agents
- AGENT

See everything inside

What's inside

Skills

/codeguardA CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed./memory-safe-migrationGuide secure migration of code from memory-unsafe languages (C, C++, Assembly) to memory-safe languages (Rust, Go, Java, C#, Swift). Use when migrating or rewriting legacy C/C++ code, designing FFI boundaries between safe and unsafe code, writing new modules in existing C/C++/security-reviewComprehensive security code review workflow for a target repository, producing a markdown report with findings and recommendations.

Agents

AGENTReview the current repository for CodeGuard rule violations and emit SARIF 2.1.0 findings. Use when the user explicitly asks for a security scan, security review, SARIF output, or CodeGuard compliance check. Do NOT activate for general code writing or editing.

Badges

README

Read on GitHub

Project CodeGuard: Security Skills and Rules for AI Coding Agents

This repository is for the work of the Coalition for Secure AI (CoSAI). CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry-leading organizations. We are dedicated to sharing best practices for secure AI deployment and collaborating on AI security research and tool development.

For more information on CoSAI, please visit the CoSAI website and the Open Project repository, which contains our governance information and project charter.

What is Project CodeGuard?

Project CodeGuard is an AI model-agnostic security coding agent skills framework and ruleset that embeds secure-by-default practices into AI coding workflows (generation and review). It ships core security skills and rules, translators for popular coding agents, and validators to test skills and rule compliance.

Why Project CodeGuard?

AI coding agents are transforming software engineering, but this speed can introduce security vulnerabilities. Is your AI coding agent implementation introducing security vulnerabilities?

Skipping input validation
Hardcoding secrets and credentials
Using weak cryptographic algorithms
Relying on unsafe functions
Missing authentication/authorization checks
Missing any other security best practice

Project CodeGuard solves this by embedding security best practices directly into AI coding agent workflows.

During and After Code Generation.

Project CodeGuard is designed to integrate seamlessly across the entire AI coding lifecycle.

Before code generation, skills and rules can be used for the design of a product and for spec-driven development. You can use the skills and rules in the “planning phase” of an AI coding agent to steer models toward secure patterns from the start.
During code generation, skills and rules can help AI agents to prevent security issues as code is being written.
After code generation, AI agents like Cursor, GitHub Copilot, Codex, Windsurf, and Claude Code can use the rules for code review.

Security Coverage

Project CodeGuard skills and rules cover essential security domains:

Cryptography: Safe algorithms (including post-quantum cryptography), secure key management, certificate validation
Input Validation: SQL injection prevention, XSS protection, command injection defense
Authentication: MFA best practices, OAuth/OIDC, secure session management
Authorization: RBAC/ABAC, access control, IDOR prevention
Supply Chain: Dependency security, SBOM generation, vulnerability management
Cloud Security: IaC hardening, container security, Kubernetes best practices
Platform Security: Mobile apps, web services, API security
Data Protection: Privacy, encryption at rest/transit, secure storage

Quick Start

Get started in minutes:

Download the skills and rules from our releases page
Copy to your project - Place AI agent and IDE specific skills and rules in your repository
Start coding - AI assistants will automatically follow security best practices

Additional details in the Get Started →

CodeGuard MCP Server

This repository also includes an MCP server that exposes all CodeGuard security rules as tools over streamable HTTP. Organizations can deploy it on their infrastructure and connect every developer's AI coding assistant to a single, centrally managed instance. See the CodeGuard MCP Server README for setup instructions.

How It Works

Security skills and rules are written in unified markdown format (sources/ directory)
Conversion tools translate skills and rules into formats for popular coding agents
Release automation packages skills and rules into downloadable ZIP files
AI assistants reference these skills and rules when generating or reviewing code
Secure code is produced automatically without developer intervention

File tree

218

cosai-oasis/project-codeguardView on GitHub

.claude-plugin/
  marketplace.json
  plugin.json
.codex-plugin/
  plugin.json
.github/
  ISSUE_TEMPLATE/
    new-rule.yml
    rule-feedback.yml
  workflows/
    build-ide-bundles.yml
    deploy-docs.yml
    stale.yml
    update-codeguard-rules.yml
    validate-rules.yml
.gitignore
CODE-OF-CONDUCT.md
CONTRIBUTING.md
docs/
  adr/
    0001-separate-guidance-from-runtime-and-scanning.md
    index.md
    template.md
  claude-code-skill-plugin.md
  CNAME
  codeguard-reviewer.md
  codex-skill-plugin.md
  custom-rules.md
  faq.md
  getting-started.md
  images/
    codeguard-install-flowchart.svg
    context-window-no-rules.png
    context-window-with-rules.png
  index.md
  install-paths.md
  mcp-server.md
  personas.md
  skills.md
LICENSE.md
mkdocs.yml
pyproject.toml
README.md
skills/
  codeguard/
    rules/
      codeguard-0-additional-cryptography.md
      codeguard-0-api-web-services.md
      codeguard-0-authentication-mfa.md
      codeguard-0-authorization-access-control.md
      codeguard-0-client-side-web-security.md
      codeguard-0-cloud-orchestration-kubernetes.md
      codeguard-0-data-storage.md
      codeguard-0-devops-ci-cd-containers.md
      codeguard-0-file-handling-and-uploads.md
      codeguard-0-framework-and-languages.md
      codeguard-0-iac-security.md
      codeguard-0-input-validation-injection.md
      codeguard-0-logging.md
      codeguard-0-mcp-security.md
      codeguard-0-mobile-apps.md
      codeguard-0-privacy-data-protection.md
      codeguard-0-safe-c-functions.md
      codeguard-0-session-management-and-cookies.md
      codeguard-0-supply-chain-security.md
      codeguard-0-xml-and-serialization.md
      codeguard-1-crypto-algorithms.md
      codeguard-1-digital-certificates.md
      codeguard-1-hardcoded-credentials.md
    SKILL.md
sources/
  agents/
    codeguard-reviewer/
      AGENT.md
  rules/
    core/
      codeguard-0-additional-cryptography.md
      codeguard-0-api-web-services.md
      codeguard-0-authentication-mfa.md
      codeguard-0-authorization-access-control.md
      codeguard-0-client-side-web-security.md
      codeguard-0-cloud-orchestration-kubernetes.md
      codeguard-0-data-storage.md
      codeguard-0-devops-ci-cd-containers.md
      codeguard-0-file-handling-and-uploads.md
      codeguard-0-framework-and-languages.md
      codeguard-0-iac-security.md
      codeguard-0-input-validation-injection.md
      codeguard-0-logging.md
      codeguard-0-mcp-security.md
      codeguard-0-mobile-apps.md
      codeguard-0-privacy-data-protection.md
      codeguard-0-safe-c-functions.md
      codeguard-0-session-management-and-cookies.md
      codeguard-0-supply-chain-security.md
      codeguard-0-xml-and-serialization.md
      codeguard-1-crypto-algorithms.md
      codeguard-1-digital-certificates.md
      codeguard-1-hardcoded-credentials.md
      codeguard-SKILLS.md.template
    owasp/
      codeguard-0-ajax-security.md
      codeguard-0-attack-surface-analysis.md
      codeguard-0-authentication.md
      codeguard-0-authorization-testing-automation.md
      codeguard-0-authorization.md
      codeguard-0-bean-validation.md
      codeguard-0-browser-extension-vulnerabilities.md
      codeguard-0-c-based-toolchain-hardening.md
      codeguard-0-choosing-and-using-security-questions.md
      codeguard-0-ci-cd-security.md
      codeguard-0-clickjacking-defense.md
      codeguard-0-content-security-policy.md
      codeguard-0-cookie-theft-mitigation.md
      codeguard-0-credential-stuffing-prevention.md
      codeguard-0-cross-site-request-forgery-prevention.md
      codeguard-0-cross-site-scripting-prevention.md
      codeguard-0-cryptographic-storage.md
      codeguard-0-cw-cryptographic-security-guidelines.md
      codeguard-0-cw-memory-string-usage-guidelines.md
      codeguard-0-database-security.md
      codeguard-0-deserialization.md
      codeguard-0-django-rest-framework.md
      codeguard-0-django-security.md
      codeguard-0-docker-security.md
      codeguard-0-dom-based-xss-prevention.md
      codeguard-0-dom-clobbering-prevention.md
      codeguard-0-dotnet-security.md
      codeguard-0-error-handling.md
      codeguard-0-file-upload.md
      codeguard-0-forgot-password.md
      codeguard-0-graphql.md
      codeguard-0-html5-security.md
      codeguard-0-http-headers.md
      codeguard-0-http-strict-transport-security.md
      codeguard-0-injection-prevention.md
      codeguard-0-input-validation.md
      codeguard-0-insecure-direct-object-reference-prevention.md
      codeguard-0-jaas.md
      codeguard-0-java-security.md
      codeguard-0-json-web-token-for-java.md
      codeguard-0-key-management.md
      codeguard-0-kubernetes-security.md
      codeguard-0-laravel.md
      codeguard-0-ldap-injection-prevention.md
      codeguard-0-legacy-application-management.md
      codeguard-0-logging-vocabulary.md
      codeguard-0-mass-assignment.md
      codeguard-0-microservices-security.md
      codeguard-0-mobile-application-security.md
      codeguard-0-multifactor-authentication.md
      codeguard-0-network-segmentation.md
      codeguard-0-nodejs-docker.md
      codeguard-0-nodejs-security.md
      codeguard-0-npm-security.md
      codeguard-0-oauth2.md
      codeguard-0-open-redirect.md
      codeguard-0-os-command-injection-defense.md
      codeguard-0-password-storage.md
      codeguard-0-php-configuration.md
      codeguard-0-pinning.md
      codeguard-0-prototype-pollution-prevention.md
      codeguard-0-query-parameterization.md
      codeguard-0-rest-assessment.md
      codeguard-0-rest-security.md
      codeguard-0-ruby-on-rails.md
      codeguard-0-saml-security.md
      codeguard-0-securing-cascading-style-sheets.md
      codeguard-0-server-side-request-forgery-prevention.md
      codeguard-0-session-management.md
      codeguard-0-sql-injection-prevention.md
      codeguard-0-symfony.md
      codeguard-0-third-party-javascript-management.md
      codeguard-0-threat-modeling.md
      codeguard-0-transaction-authorization.md
      codeguard-0-transport-layer-security.md
      codeguard-0-unvalidated-redirects-and-forwards.md
      codeguard-0-user-privacy-protection.md
      codeguard-0-virtual-patching.md
      codeguard-0-vulnerable-dependency-management.md
      codeguard-0-web-service-security.md
      codeguard-0-xml-external-entity-prevention.md
      codeguard-0-xml-security.md
      codeguard-0-xs-leaks.md
      codeguard-0-xss-filter-evasion.md
      codeguard-0-zero-trust-architecture.md
  skills/
    memory-safe-migration/
      references/
        assessment-checklist.md
        ffi-security.md
        language-selection.md
        migration-patterns.md
      scripts/
        assess-migration.py
      SKILL.md
    security-review/
      Security_Code_Reviewer_Guidelines.md
      SKILL.md
  templates/
    custom-rule-template.md.example
src/
  artifact_targets.py
  codeguard-mcp/
    .agents/
      skills/
        codeguard-mcp-meta/
          SKILL.md
    .env.example
    docker-compose.yml
    Dockerfile
    pyproject.toml
    README.md
    src/
      codeguard_mcp/
        __init__.py
        __main__.py
        config.py
        log.py
        rule_processor.py
        server.py
        tool_factory.py
    tests/
      __init__.py
      test_rule_processor.py
      test_smoke.py
      test_tool_factory.py
    uv.lock
  convert_to_ide_formats.py
  converter.py
  emit_agents.py
  formats/
    __init__.py
    agentskills.py
    antigravity.py
    base.py
    claude.py
    codex.py
    copilot.py
    cursor.py
    hermes.py
    openclaw.py
    opencode.py
    windsurf.py
  language_mappings.py
  tag_mappings.py
  utils.py
  validate_unified_rules.py
  validate_versions.py
uv.lock

FAQ

cosai-oasis-codeguard-security is a Claude Code plugin with 3 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes codeguard, memory-safe-migration, security-review. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

What is cosai-oasis-codeguard-security?: This repository is for the work of the Coalition for Secure AI (CoSAI). CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry-leading organizations.
How do I install cosai-oasis-codeguard-security?: Run these in Claude Code: /plugin marketplace add cosai-oasis/project-codeguard then /plugin install codeguard-security@project-codeguard. Then prompt normally.
Does cosai-oasis-codeguard-security auto-invoke its skills?: Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
Is cosai-oasis-codeguard-security free?: Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.