build.ts stamps the current month/year into AGENTS.md, and the zip
files mtime-rebuild from those. Refreshing here so CI's
no-uncommitted-changes guard passes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The pnpm security settings added in the previous commit
(strictDepBuilds, minimumReleaseAge, trustPolicy) require pnpm >=10.21,
and engines.pnpm gates installation. Bump pnpm/action-setup to v10 in
all three workflows (ci, release, security).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rebuilds the generated outputs for skills/code-security after the rule
content updates in #13 (commit ddc19af). The source rule files were
updated but `make` was not run, so the compiled AGENTS.md and extracted
test cases drifted from the rules.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fix potential shell injection in the release workflow by using environment variables instead of direct interpolation.
## Changes
- Move `github.event_name` and `inputs.version` to environment variables (`EVENT_NAME` and `INPUT_VERSION`)
- Reference these environment variables in the shell script instead of using `${{ }}` interpolation directly in the `run:` block
## Why
Direct interpolation of `${{ inputs.version }}` in a `run:` step is vulnerable to shell injection attacks. A malicious actor could craft a version input containing shell metacharacters to execute arbitrary commands, potentially stealing secrets or compromising the runner. By passing values through environment variables, the shell treats them as literal strings rather than executable code, eliminating the injection vector.
## Semgrep Finding Details
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
@409041 requested Semgrep Assistant generate this pull request to fix [a finding](https://semgrep.dev/orgs/semgrep/findings/698924849) from the detection rule [yaml.github-actions.security.run-shell-injection.run-shell-injection](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection).
- CI workflow: validates and builds on PRs, fails if generated files are out of sync
- Release workflow: creates GitHub releases with skill zips on version tags
- Security workflow: weekly pnpm audit and outdated dependency checks
- Dependabot config: automated weekly dependency updates for npm and actions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Combines functionality from Trail of Bits' semgrep and semgrep-rule-creator skills:
- Running Semgrep scans with curated rulesets
- Creating custom detection rules with pattern matching and taint mode
- Test-driven rule development workflow
- CI/CD integration examples
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create sections.ts to parse _sections.md dynamically
- Eliminate hardcoded section map from parser.ts (was 28 entries)
- Replace duplicate parsing code in build.ts with shared module
- _sections.md is now the single source of truth for section metadata
Adding a new rule now only requires updating _sections.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace React performance section map with security categories (1-28)
- Fix _sections.md parsing to use ### headings instead of ##
- Each rule now maps to its proper section by filename
Now generates 28 sections organized by impact level:
- Critical (1-9): SQL injection, XSS, secrets, etc.
- High (10-22): Crypto, SSRF, Terraform, K8s, etc.
- Medium (23-25): Regex DoS, race conditions
- Low (26-28): Best practices, performance
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Rule consistency:
- Add missing impactDescription and tags to 15 rule files
- Standardize reference format to **References:** across all rules
- Update _template.md with correct reference format
Parser improvements:
- Replace regex-based parser with AST-based parsing using remark/unified
- Add unified, remark-parse, remark-frontmatter, unist-util-visit, js-yaml
- More robust extraction of frontmatter, examples, and code blocks
Validation improvements:
- Add warnings for missing optional fields (impactDescription, tags)
- Report all errors/warnings instead of stopping on first error
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Leif