Combines functionality from Trail of Bits' semgrep and semgrep-rule-creator skills:
- Running Semgrep scans with curated rulesets
- Creating custom detection rules with pattern matching and taint mode
- Test-driven rule development workflow
- CI/CD integration examples
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create sections.ts to parse _sections.md dynamically
- Eliminate hardcoded section map from parser.ts (was 28 entries)
- Replace duplicate parsing code in build.ts with shared module
- _sections.md is now the single source of truth for section metadata
Adding a new rule now only requires updating _sections.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace React performance section map with security categories (1-28)
- Fix _sections.md parsing to use ### headings instead of ##
- Each rule now maps to its proper section by filename
Now generates 28 sections organized by impact level:
- Critical (1-9): SQL injection, XSS, secrets, etc.
- High (10-22): Crypto, SSRF, Terraform, K8s, etc.
- Medium (23-25): Regex DoS, race conditions
- Low (26-28): Best practices, performance
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Rule consistency:
- Add missing impactDescription and tags to 15 rule files
- Standardize reference format to **References:** across all rules
- Update _template.md with correct reference format
Parser improvements:
- Replace regex-based parser with AST-based parsing using remark/unified
- Add unified, remark-parse, remark-frontmatter, unist-util-visit, js-yaml
- More robust extraction of frontmatter, examples, and code blocks
Validation improvements:
- Add warnings for missing optional fields (impactDescription, tags)
- Report all errors/warnings instead of stopping on first error
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added all 28 security rule categories organized by impact level
- Listed supported languages (15+)
- Expanded use cases to include infrastructure configuration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Targets:
- make all/release: validate, build, and create zip packages
- make validate: validate rule files via pnpm
- make build: build skill files
- make zip: create zip packages for all skills
- make clean: remove generated files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Drew Dennison