Creating a CodeGuard Claude Code Skill and plugin structure and documentation

[santosomar]

Fixes #42

This pull request introduces the initial integration of Project CodeGuard's security framework into a Claude Code plugin and related skill to provide comprehensive resources and configuration for secure AI-assisted coding.

The changes include new plugin metadata, documentation, and a set of foundational security rule files for software security skills. These resources are designed to help AI coding agents prevent vulnerabilities and enforce secure-by-default practices across authentication, authorization, cryptography, API/web services, and more.

Project CodeGuard Integration and Plugin Configuration

• Added .claude-plugin/marketplace.json and .claude-plugin/plugin.json to register the new codeguard-security plugin, including metadata, ownership, repository links, and keywords for marketplace discovery. [1] [2]

Documentation and Guidance

• Created skills/software-security/SKILL.md to document usage instructions, workflow, and guidance for applying Project CodeGuard rules during code writing and review.

Security Rule Files (Software Security Skill)

• Added foundational security rule files under skills/software-security/rules/ covering:
  • Authentication & MFA best practices (codeguard-0-authentication-mfa.md)
  • Authorization & access control, including IDOR and mass assignment prevention (codeguard-0-authorization-access-control.md)
  • API & web service security, schema validation, SSRF, and rate limiting (codeguard-0-api-web-services.md)
  • Cryptography and TLS configuration, key management, and HSTS/pinning (codeguard-0-additional-cryptography.md)

Repository and Linguist Configuration

• Updated .gitattributes to improve linguist detection for documentation and markdown files, and to exclude certain files from export. (.gitattributes)

---

Some additional references:

• Anthropic's Skills Announcement https://www.anthropic.com/engineering/equipping-agents-for-the-real-world-with-agent-skills
• Agent Skills https://docs.claude.com/en/docs/agents-and-tools/agent-skills/overview
• Using Skills in Claude Code https://docs.claude.com/en/docs/claude-code/skills
• Plugin Marketplaces https://docs.claude.com/en/docs/claude-code/plugin-marketplaces

[Copilot]

Pull Request Overview

Initial integration of Project CodeGuard into a Claude Code plugin/skill, adding metadata, documentation, packaging script, and a comprehensive set of security rule files to guide secure-by-default coding.

• Adds .claude-plugin metadata (plugin.json, marketplace.json) for marketplace discovery and install.
• Introduces the software-security skill (SKILL.md) and 22 rule files spanning core AppSec domains.
• Provides a packaging/prep script and documentation for setup and local testing; updates .gitattributes for linguist.

Reviewed Changes

Copilot reviewed 28 out of 29 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
src/prepare-claude-code-plugin.sh	Build/prep script to copy rules into the skill structure, verify required files, and print local testing instructions.
skills/software-security/SKILL.md	Defines the security skill, usage workflow, and how rules are applied.
skills/software-security/rules/codeguard-1-safe-c-functions.md	C/C++ memory/string safety guidance, insecure-to-safe replacements, examples, and checklists.
skills/software-security/rules/codeguard-1-hardcoded-credentials.md	Prohibits secrets in source; recognition patterns and guidance.
skills/software-security/rules/codeguard-1-digital-certificates.md	Certificate recognition and mandatory checks (expiry, key strength, signature, issuer type).
skills/software-security/rules/codeguard-1-crypto-algorithms.md	Crypto algorithms/APIs guidance and banned/deprecated lists.
skills/software-security/rules/codeguard-0-xml-and-serialization.md	XML hardening and safe deserialization guidelines per language.
skills/software-security/rules/codeguard-0-supply-chain-security.md	Dependency/SBOM/provenance and CI policy guidance.
skills/software-security/rules/codeguard-0-session-management-and-cookies.md	Session/cookie hardening and lifecycle controls.
skills/software-security/rules/codeguard-0-privacy-data-protection.md	Privacy/data protection guidance and auth UX notes.
skills/software-security/rules/codeguard-0-mobile-apps.md	iOS/Android security practices.
skills/software-security/rules/codeguard-0-logging.md	Structured logging/redaction/alerting guidance.
skills/software-security/rules/codeguard-0-input-validation-injection.md	Validation/parameterization and injection defenses.
skills/software-security/rules/codeguard-0-iac-security.md	IaC/cloud hardening controls.
skills/software-security/rules/codeguard-0-framework-and-languages.md	Framework-specific secure defaults (Django, Rails, .NET, etc.).
skills/software-security/rules/codeguard-0-file-handling-and-uploads.md	Secure upload/storage/validation guidance.
skills/software-security/rules/codeguard-0-devops-ci-cd-containers.md	CI/CD and container hardening.
skills/software-security/rules/codeguard-0-data-storage.md	DB hardening, TLS, least privilege, auditing.
skills/software-security/rules/codeguard-0-cloud-orchestration-kubernetes.md	Kubernetes RBAC/policy/networking/secrets guidance.
skills/software-security/rules/codeguard-0-client-side-web-security.md	Client-side XSS/CSP/CSRF/clickjacking/XS-Leaks controls.
skills/software-security/rules/codeguard-0-authorization-access-control.md	AuthZ, IDOR prevention, mass assignment, step-up.
skills/software-security/rules/codeguard-0-authentication-mfa.md	Auth/MFA, password hashing, federation, tokens.
skills/software-security/rules/codeguard-0-api-web-services.md	API security across REST/GraphQL/SOAP, SSRF, rate limits.
skills/software-security/rules/codeguard-0-additional-cryptography.md	TLS/HSTS/pinning, key mgmt, AEAD usage.
docs/claude-code-skill-plugin.md	Plugin overview, install, workflow, and team deployment docs.
.gitattributes	Linguist tuning for markdown and plugin docs.
.claude-plugin/plugin.json	Plugin metadata (name, version, author, keywords).
.claude-plugin/marketplace.json	Marketplace catalog entry for the plugin.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[santosomar]

This PR successfully creates a comprehensive Claude Code plugin structure for Project CodeGuard.

✅ Excellent Structure & Documentation

• Well-organized plugin metadata in .claude-plugin/ with proper JSON structure
• Comprehensive 405-line documentation explaining installation, usage, and examples
• Clear skill definition with proper frontmatter and workflow description

✅ Comprehensive Security Coverage

• rule files covering all major security domains:
• 4 always-apply critical rules (hardcoded credentials, crypto, certificates, C functions)
• 18 context-specific rules (authentication, injection, APIs, cloud, etc.)
• Rules are well-structured with proper YAML frontmatter and detailed implementation guidance

✅ High-Quality Security Content

• Detailed, actionable security rules with checklists and examples
• Modern security practices (Argon2id, PKCE, WebAuthn, parameterized queries)
• Language-specific guidance across 10+ programming languages
• Clear "always apply" vs "context-specific" categorization

✅ Professional Implementation

• Valid JSON configuration files
• Working preparation script that properly copies rules
• Proper git configuration updates (.gitattributes, .gitignore)
• Follows plugin packaging standards

✅ Technical Quality Check

• All JSON files validate successfully
• Plugin preparation script runs without errors
• Proper file organization and naming conventions
• Comprehensive installation and usage instructions

[Copilot]

Pull Request Overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 6 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[santosomar]

@ramraaj25 @thomas-bartlett - should we merge this one and then #46 and #47 ?

[Copilot]

Pull Request Overview

Copilot reviewed 27 out of 28 changed files in this pull request and generated 2 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Pull Request Overview

Copilot reviewed 27 out of 28 changed files in this pull request and generated 2 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[ramraaj25]

@ramraaj25 @thomas-bartlett - should we merge this one and then #46 and #47 ?

Yes, that would be great!

Edit: Since our PR's target was develop and they are merged, we can merge this to main and we should be good

[Copilot]

Pull Request Overview

Copilot reviewed 33 out of 34 changed files in this pull request and generated 2 comments.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}