TTMK7777

Code Validator — Security skill for Claude Code

Security community

Static security scanner purpose-built for AI-generated code (Claude Code, GitHub Copilot, ChatGPT, Cursor).

How to install Code Validator

This entry records only its repository, not the path inside it, so there is no exact command to give. Open TTMK7777/code-validator and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Code Validator does

Static security scanner purpose-built for AI-generated code (Claude Code, GitHub Copilot, ChatGPT, Cursor). Detects hardcoded credentials, CORS misconfigurations, SQL injection, and dependency CVEs in under 1 second per file — fully offline, zero data exfiltration.

Alternatives in Security

Google Workspace Model Armor — Filter user-generated content for safety 21.6k ★
Security Scan Report — Generated: 2026-04-10 20:48 UTC Skills scanned: 134 Total findings: 836 Critical: 32 High: 50 Safe skills: 100 18.1k ★
Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★

README

code-validator

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](https://www.python.org/downloads/) [![Offline](https://img.shields.io/badge/runs-offline-green.svg)](#) [![AI Code](https://img.shields.io/badge/scans-AI--generated_code-purple.svg)](#)

**What is code-validator?** A static security scanner purpose-built for code produced by AI assistants (Claude, ChatGPT, GitHub Copilot, Cursor). Detects hardcoded credentials, CORS misconfigurations, SQL injection patterns, and dependency CVEs — in under 1 second per file, fully offline, with zero external API calls.

**Why this exists:** AI assistants frequently emit code that *looks* correct but contains subtle security defects — hardcoded API keys in examples, `allow_origins=["*"]` with `allow_credentials=True`, string-concatenated SQL. `code-validator` is the lightweight CI gate that catches these *before* they reach `main`.


🎯 Use case	Block insecure AI-generated code at PR time
⚡ Speed	<1s per file, `--git-diff` mode scans only changed files
🔒 Privacy	100% offline. No code leaves your machine. Only dependency: `pydantic`
🧪 Detection rules	20 rules across security, quality, and dependency layers (SEC001–SEC013 excluding SEC007, QUAL001–QUAL002, DEP001–DEP006)
📦 Install	`pip install -r requirements.txt` — done

Features

Security Scanning

Hardcoded credentials: API keys (OpenAI, Anthropic, Google, GitHub tokens), passwords, database URLs, Django/Flask SECRET_KEY, AWS access keys, and embedded PEM private keys
Dangerous CORS configurations: wildcard origins, and wildcard origins combined with allow_credentials=True
SQL injection patterns: f-string interpolation, + concatenation, str.format(), and % operator
Command injection: os.system / os.popen / `subproce