# Security Cards Agent Usage

> A concise guide for AI agents using Security Cards in software projects.

- Complete catalog: https://securitycards.rewarelabs.com/llms.txt
- JSON catalog: https://securitycards.rewarelabs.com/catalog.json
- This guide: https://securitycards.rewarelabs.com/agent-usage.md

## Recommended: use the Security Cards skill

The `securitycards` skill gives a coding agent this workflow and includes a small catalog snapshot. The snapshot can confirm what was supported when the skill was released, but the live catalog and cards remain the source of truth.

Install it globally from the [RewareLabs/securitycards repository](https://github.com/Reware-Labs/securitycards):

```bash
npx skills add Reware-Labs/securitycards --skill securitycards -g
```

Remove `-g` to install it only for the current project. If the skill is already installed, use it for the task. If installation is not available or has not been authorized, continue with the instructions below.

## How to use Security Cards

1. Check the project’s manifests and lockfiles to identify the libraries and versions actually in use.
2. Open the [catalog index](https://securitycards.rewarelabs.com/llms.txt), follow the link to your language’s catalog (`/llms/<language>.txt`), and find the line for your library and version. That line ends with the complete list of categories published for the version, and gives the URL prefix its cards hang off. Fetch with a tool that returns raw bytes, such as `curl -fsS`; a tool that summarizes or truncates can silently drop your library and make a supported version look unsupported. The [full JSON catalog](https://securitycards.rewarelabs.com/catalog.json) holds every language at once and is large — reach for it only when you need the whole inventory.
3. Use cards that match the project’s exact library version. If that version is not listed, explain what is unsupported and show the versions that are available instead of borrowing guidance from another version.
4. When starting a project or learning a library, begin with its Security Blueprint. For focused work, choose the category card closest to the task. Use the full library bundle when several categories are relevant.
5. Apply the relevant **secure rules**, run appropriate tests or checks, and review the finished code against the rules used.
6. Include links to every Security Blueprint or card used.

If the site cannot be reached, an installed skill’s catalog snapshot can only show whether a library was supported when the skill was released. Wait for the live cards before applying security guidance, because the snapshot may be out of date.

## Common workflows

### 1. Starting a project

- Select exact supported versions and read each library’s Security Blueprint before establishing architecture or defaults.
- Create persistent project instructions when useful and cite the sources used in the implementation plan.

### 2. Building a feature

- Confirm resolved dependency versions, fetch the most focused cards that apply, follow their secure rules, and verify the implementation.

### 3. Reviewing an existing codebase

- Check the project’s dependencies, compare the relevant code with the applicable secure rules, and report concrete findings with severity, location, a suggested fix, and links to the cards used.