# Security Cards Agent Usage

> A concise guide for AI agents using Security Cards in software projects.

- Complete catalog: https://securitycards.rewarelabs.com/llms.txt
- JSON catalog: https://securitycards.rewarelabs.com/catalog.json
- This guide: https://securitycards.rewarelabs.com/agent-usage.md

## Recommended: use the Security Cards skill

The `securitycards` skill gives a coding agent this workflow and includes a small catalog snapshot. The snapshot can confirm what was supported when the skill was released, but the live catalog and cards remain the source of truth.

Install it globally from the [RewareLabs/securitycards repository](https://github.com/Reware-Labs/securitycards):

```bash
npx skills add Reware-Labs/securitycards --skill securitycards -g
```

Remove `-g` to install it only for the current project. If the skill is already installed, use it for the task. If installation is not available or has not been authorized, continue with the instructions below.

## How to use Security Cards

1. Check the project’s manifests and lockfiles to identify the libraries and versions actually in use.
2. Find those versions in the [JSON catalog](https://securitycards.rewarelabs.com/catalog.json). If needed, use the [text catalog](https://securitycards.rewarelabs.com/llms.txt) instead.
3. Use cards that match the project’s exact library version. If that version is not listed, explain what is unsupported and show the versions that are available instead of borrowing guidance from another version.
4. When starting a project or learning a library, begin with its Security Blueprint. For focused work, choose the category card closest to the task. Use the full library bundle when several categories are relevant.
5. Apply the relevant **secure rules**, run appropriate tests or checks, and review the finished code against the rules used.
6. Include links to every Security Blueprint or card used.

If the site cannot be reached, an installed skill’s catalog snapshot can only show whether a library was supported when the skill was released. Wait for the live cards before applying security guidance, because the snapshot may be out of date.

## Common workflows

### 1. Starting a project

- Select exact supported versions and read each library’s Security Blueprint before establishing architecture or defaults.
- Create persistent project instructions when useful and cite the sources used in the implementation plan.

### 2. Building a feature

- Confirm resolved dependency versions, fetch the most focused cards that apply, follow their secure rules, and verify the implementation.

### 3. Reviewing an existing codebase

- Check the project’s dependencies, compare the relevant code with the applicable secure rules, and report concrete findings with severity, location, a suggested fix, and links to the cards used.