rea
Reverse engineer anything with agents, from app behavior down to native binaries.
420k
@morlutoSecurity
Plugin
cosai-oasis-codeguard-security
A security plugin with skills that help AI coding agents write secure code, guide migration of C and C++ code to memory-safe languages, and produce markdown security review reports for a repository.
Plugin Signal69/100Solid
maintained98
capable34
documented80
adopted54
Claude Code
> /plugin marketplace add cosai-oasis/project-codeguard> /plugin install codeguard-security@project-codeguard
Codex
$ npx skills add cosai-oasis/project-codeguard -a codex
Cursor
$ npx skills add cosai-oasis/project-codeguard -a cursor
Gemini CLI
$ npx skills add cosai-oasis/project-codeguard -a gemini-cli
GitHub Copilot
$ copilot plugin marketplace add cosai-oasis/project-codeguard$ copilot plugin install codeguard-security@project-codeguard
OpenCode
$ npx skills add cosai-oasis/project-codeguard -a opencode
Windsurf
$ npx skills add cosai-oasis/project-codeguard -a windsurf
In this plugin
See everything inside What's inside
3 Skills
/codeguardA CodeGuard security skill that helps AI coding agents write secure code and prevent common vulnerabilities. Use this skill when writing, reviewing, or modifying code to ensure secure-by-default practices are followed./memory-safe-migrationGuide secure migration of code from memory-unsafe languages (C, C++, Assembly) to memory-safe languages (Rust, Go, Java, C#, Swift). Use when migrating or rewriting legacy C/C++ code, designing FFI boundaries between safe and unsafe code, writing new modules in existing C/C++/security-reviewComprehensive security code review workflow for a target repository, producing a markdown report with findings and recommendations.
Links
Badges
README
Project CodeGuard: Security Skills and Rules for AI Coding Agents
This repository is for the work of the Coalition for Secure AI (CoSAI). CoSAI is an OASIS Open Project and an open ecosystem of AI and security experts from industry-leading organizations. We are dedicated to sharing best practices for secure AI deployment and collaborating on AI security research and tool development.
For more information on CoSAI, please visit the CoSAI website and the Open Project repository, which contains our governance information and project charter.
What is Project CodeGuard?
Project CodeGuard is an AI model-agnostic security coding agent skills framework and ruleset that embeds secure-by-default practices into AI coding workflows (generation and review). It ships core security skills and rules, translators for popular coding agents, and validators to test skills and rule compliance.
Why Project CodeGuard?
AI coding agents are transforming software engineering, but this speed can introduce security vulnerabilities. Is your AI coding agent implementation introducing security vulnerabilities?
- Skipping input validation
- Hardcoding secrets and credentials
- Using weak cryptographic algorithms
- Relying on unsafe functions
- Missing authentication/authorization checks
- Missing any other security best practice
Project CodeGuard solves this by embedding security best practices directly into AI coding agent workflows.
During and After Code Generation.
Project CodeGuard is designed to integrate seamlessly across the entire AI coding lifecycle.
- Before code generation, skills and rules can be used for the design of a product and for spec-driven development. You can use the skills and rules in the “planning phase” of an AI coding agent to steer models toward secure patterns from the start.
- During code generation, skills and rules can help AI agents to prevent security issues as code is being written.
- After code generation, AI agents like Cursor, GitHub Copilot, Codex, Windsurf, Devin, and Claude Code can use the rules for code review.
Security Coverage
Project CodeGuard skills and rules cover essential security domains:
- Cryptography: Safe algorithms (including post-quantum cryptography), secure key management, certificate validation
- Input Validation: SQL injection prevention, XSS protection, command injection defense
- Authentication: MFA best practices, OAuth/OIDC, secure session management
- Authorization: RBAC/ABAC, access control, IDOR prevention
- Supply Chain: Dependency security, SBOM generation, vulnerability management
- Cloud Security: IaC hardening, container security, Kubernetes best practices
- Platform Security: Mobile apps, web services, API security
- Data Protection: Privacy, encryption at rest/transit, secure storage
Quick Start
Get started in minutes:
- Download the skills and rules from our releases page
- Copy to your project - Place AI agent and IDE specific skills and rules in your repository
- Start coding - AI assistants will automatically follow security best practices
- Additional details in the Get Started →
CodeGuard MCP Server
This repository also includes an MCP server that exposes all CodeGuard security rules as tools over streamable HTTP. Organizations can deploy it on their infrastructure and connect every developer's AI coding assistant to a single, centrally managed instance. See the CodeGuard MCP Server README for setup instructions.
How It Works
- Security skills and rules are written in unified markdown format (
sources/directory) - Conversion tools translate skills and rules into formats for popular coding agents
- Release automation packages skills and rules into downloadable ZIP files
- AI assistants reference these skills and rules when generating or reviewing code
- Secure code is produced automatically without developer intervention
Stars on GitHub
Momentum
- stars in total
- 367
File tree
Similar plugins.
@morlutoreverse-skill
A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
46 skills44k
@zhaoxuya520cybersecurity-skills
Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
200 skills36k
@mukul975watermarks-remover
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
2 skills1 hook26k
@guillaumemeyerQuestions about cosai-oasis-codeguard-security.
Install it with the command on its page. It includes codeguard, memory-safe-migration, security-review. Its skills do not fire on their own yet. Free and open source.
- What is cosai-oasis-codeguard-security?
- cosai-oasis/project-codeguard is a security plugin of skills and agents from the Coalition for Secure AI that helps AI coding agents write secure code and prevent common vulnerabilities. Use it when writing, reviewing, or modifying code, or when migrating legacy C or C++ code to memory-safe languages.
- How do I install cosai-oasis-codeguard-security?
- Run these in Claude Code: /plugin marketplace add cosai-oasis/project-codeguard then /plugin install codeguard-security@project-codeguard. Then prompt normally.
- Does cosai-oasis-codeguard-security auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin.
- Is cosai-oasis-codeguard-security free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
- Which coding agents can use cosai-oasis-codeguard-security's skills?
- cosai-oasis-codeguard-security installs in Claude Code, and its skills also install in Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI. Each skill's page has the install command. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it