49 个 · 按相关度排序
Port an existing Semgrep rule to specified programming languages, producing separate rule and test files for each. The skill checks applicability, adapts detection patterns to each language, and reports validation results.
中文简介正在准备中。当前显示英语简介。
Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.
中文简介正在准备中。当前显示英语简介。
Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.
中文简介正在准备中。当前显示英语简介。
Find other occurrences of a known bug across a codebase by tracing its root cause. Gradually broaden search patterns, assess matching candidates, assign severity, and document findings with rules to help prevent recurrence.
中文简介正在准备中。当前显示英语简介。
Uses a known or suspected vulnerability to find related code through Trailmark's graph of calls, types, and implementations. Produces ranked review targets with reasons and limitations for follow-up security analysis.
中文简介正在准备中。当前显示英语简介。
Connect static analysis results and human audit notes to a Trailmark code graph. Group findings by severity and compare them with input flow, impact, and privilege boundaries to prioritize investigation and understand findings in their code context.
中文简介正在准备中。当前显示英语简介。
Review authorized source code or pull request changes for security flaws. Combine automated static analysis, which checks code without running it, with manual validation to document affected locations, data flows, reproduction examples, and suggested fixes.
中文简介正在准备中。当前显示英语简介。
Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.
中文简介正在准备中。当前显示英语简介。
Process SARIF files, a standard format for static analysis results, to filter alerts, remove duplicates, combine findings from multiple tools, and produce reports. It also supports comparing runs and integrating result checks into CI/CD pipelines.
中文简介正在准备中。当前显示英语简介。
Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis. Use when Semgrep or a static-analysis scan is requested; use security-review for a manual audit.
中文简介正在准备中。当前显示原文说明。
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
中文简介正在准备中。当前显示原文说明。
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
中文简介正在准备中。当前显示原文说明。
Write custom Semgrep rules to identify organization-specific logic flaws, improper cryptography usage, or missing authorization checks during source code review. This skill focuses on moving beyond default rulesets to locate complex vulnerabilities.
中文简介正在准备中。当前显示原文说明。
Use when working with Semgrep — semgrep static application security testing (SAST). Covers code scanning, custom rule creation, CI integration, autofix capabilities, multi-language support, and vulnerability triage. Use when scanning source code for security vulnerabilities, creating custom detection rules, or integrating SAST into CI pipelines.
中文简介正在准备中。当前显示原文说明。
Write custom Semgrep SAST rules in YAML to tespit etmeapplication-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.
中文简介正在准备中。当前显示原文说明。
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.
中文简介正在准备中。当前显示原文说明。
Create custom Semgrep rules for detecting project-specific vulnerabilities, enforcing coding standards, and building domain-specific security checks with proper testing and metadata.
中文简介正在准备中。当前显示原文说明。
Static application security testing (SAST) for changed source files — Vulnetix's built-in rule set plus optional Semgrep augmentation when `.semgrep` config is present. Use when reviewing a PR for code-level vulnerabilities, scanning a feature branch before merge, gating CI on critical findings, or running rule-specific checks for a known weakness class.
中文简介正在准备中。当前显示原文说明。
bu skill covers integrating Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines. It addresses configuring automated code scanning on pull requests and pushes, tuning rules to reduce false positives, uploading SARIF results to GitHub Advanced Security, and establishing quality gates that block merges when high-severity vulnerabilities are Detected.
中文简介正在准备中。当前显示原文说明。
从代码仓库中查找可通过外部请求或用户输入利用的漏洞，追踪输入到危险操作的路径，验证复现步骤与影响，并整理漏洞奖励计划所需的报告依据。
Define project quality standards in CONSTRAINTS.md, connect measurable targets to checks, and inspect changes for weakened safeguards. It helps teams choose thresholds and catch skipped tests, suppressed warnings, unfinished code, or lowered standards during agent development.
中文简介正在准备中。当前显示英语简介。
Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.
中文简介正在准备中。当前显示英语简介。
Build a GitLab CI/CD pipeline with automated checks for vulnerable code, dependencies, container images, running applications, and exposed secrets. Covers scanner configuration, consolidated findings, and approval policies for serious vulnerabilities before production deployment.
中文简介正在准备中。当前显示英语简介。
Assess web applications, APIs, and infrastructure for security weaknesses through authorized testing. The skill guides code review, dependency and secret scanning, targeted vulnerability checks, and report creation with evidence, severity ratings, and remediation priorities.
中文简介正在准备中。当前显示英语简介。