secure-code-write

# Vulnetix Secure Code Write Skill ## Use when - About to write authentication, crypto, SQL, deserialization, file-handling, or template code. - Coaching a junior on a new security-sensitive feature. - Pair-programming a security-sensitive change with a reviewer who wants to surface rules upfront. - Reviewing a PR and want the rule digest the author should have seen. - Cross-referencing the SAST rules that would fail BEFORE writing the code that triggers them. ## Don't use for - Actually scanning code — use `/vulnetix:sast-scan`. - Generic security advice — this skill is rule-grounded, not narrative. - Educating non-developer audiences — the rule digest is engineer-targeted. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. A coach, not a scanner. Use this when about to author auth, crypto, SQL, deserialization, file-handling, or templating code — surfaces the rules a reviewer would check, before you write the buggy version. ## Step 1: Load capabilities + decide topic Read `.vulnetix/capabilities.yaml`. Determine language from `derived.primary_package_manager` or the file...