'semgrep' 검색 결과

Assess web applications, APIs, and infrastructure for security weaknesses through authorized testing. The skill guides code review, dependency and secret scanning, targeted vulnerability checks, and report creation with evidence, severity ratings, and remediation priorities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check a web application against the OWASP Top 10
• Test API authentication and access controls
• Scan dependencies and Git history for security risks

Compare multiple NemoClaw pull requests addressing the same issue. It checks merge eligibility, correctness, quality, and attribution, then produces an evidence-based recommendation for merging or choosing a candidate for further repair.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Comparing competing pull requests for one issue
• Checking merge eligibility before ranking proposals
• Choosing a candidate to repair when none is ready

Helps review application code, authentication, access controls, and dependencies for security flaws. Uses OWASP guidance and CVE reports, records of known vulnerabilities, to assess impact and recommend practical fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing application code for security flaws
• Assessing known vulnerabilities in dependencies
• Checking authentication and data access controls

Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing code for security vulnerabilities
• Checking dependencies and exposed credentials
• Auditing cloud and infrastructure security

Scans code for security vulnerabilities with CodeQL by tracing data across functions. Builds and checks analysis databases, models project-specific APIs, and saves findings in SARIF, a structured results format, with broad or focused scan options.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Scanning a codebase for security vulnerabilities
• Tracing untrusted input through custom APIs
• Choosing broad or high-precision security scans

Prepare a codebase for an external security review by defining goals, running static checks, improving test coverage, and removing unused code. Assemble the review scope, verified build instructions, diagrams, and documentation into a package for auditors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing a codebase for an external security audit
• Organizing fixes and missing tests before review
• Defining the review scope and a stable code version

Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning an investigation for a new bug bounty target
• Reviewing source code for risky implementation patterns
• Testing web and AI features for security flaws

Guide bug bounty work from target research and vulnerability hunting through validation and reporting. Compare authenticated users, investigate related weaknesses, and organize reproducible evidence of practical impact before preparing a submission.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning research for an authorized bug bounty target
• Comparing API access between two test accounts
• Reviewing source code for security weaknesses

Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning research for a new bug bounty target
• Reviewing source code for security weaknesses
• Testing chatbot and AI feature security

Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube. Identify security vulnerabilities in source code before deployment. Use when implementing secure SDLC, code review automation, or security gates in CI/CD pipelines.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings. Adapted from Trail of Bits. Use after finding a bug to check if the same pattern exists elsewhere.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Static Application Security Testing patterns, OWASP Top 10 checklist, language-specific vulnerability patterns, Semgrep rule writing guide, and CI/CD integration. Use when scanning code for security vulnerabilities or writing custom SAST rules.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise. Trigger before a release or PR merge, during a security review, or when the user asks to scan the code for vulnerabilities.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when semgrep, osv-scanner, github-security or snyk MCP tools appear in your tool list - what each server is for, how to call it safely, what data leaves the machine, and how its findings are triaged

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Static analysis tool runner. Wraps ESLint, Semgrep, Bandit, Clippy, and language-specific analyzers with unified severity output. Use when deeper code analysis needed beyond pattern matching.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

代码安全审查时使用。适用于 PR 审查 / SAST 扫描 / 手动代码审计。融合 OWASP Code Review Guide + Semgrep + SonarQube。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run CodeQL and Semgrep static analysis with SARIF output for vulnerability detection, code quality assessment, and security compliance scanning across multiple languages.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Automated security scanning pipeline covering SAST (Semgrep), SCA (OWASP dependency-check), SBOM generation (Syft), vulnerability scanning (Grype), and secrets detection (detect-secrets). Invoked by security-architect for pre-commit gates, CI integration, and finding triage.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Natural-language orchestration of security tools through Gemini. Translates intent ("scan this scope for exposed admin panels") into safe, parameterized tool pipelines using nmap, masscan, naabu, httpx, nuclei, ffuf, gobuster, subfinder, amass, dnsx, katana, gau, semgrep, trivy, checkov, gitleaks, syft, grype, and custom scripts. Use when the user wants Gemini to drive a chain of CLI tools end to end with guardrails.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.