mirror of
https://github.com/semgrep/skills.git
synced 2026-09-20 14:21:26 +08:00
Drew Dennison
2e12e64d4d
Rule consistency: - Add missing impactDescription and tags to 15 rule files - Standardize reference format to **References:** across all rules - Update _template.md with correct reference format Parser improvements: - Replace regex-based parser with AST-based parsing using remark/unified - Add unified, remark-parse, remark-frontmatter, unist-util-visit, js-yaml - More robust extraction of frontmatter, examples, and code blocks Validation improvements: - Add warnings for missing optional fields (impactDescription, tags) - Report all errors/warnings instead of stopping on first error Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Code Security Build Tools
Build tooling for validating, compiling, and testing the code-security skill.
Overview
This package provides tools to:
- Validate rule files follow the correct format
- Build compiled outputs (AGENTS.md, test-cases.json)
- Extract test cases for LLM evaluation
Installation
pnpm install
Scripts
| Command | Description |
|---|---|
pnpm validate |
Validate all rule files in skills/code-security/rules/ |
pnpm build |
Build AGENTS.md and extract test cases |
pnpm build-agents |
Build only AGENTS.md |
pnpm extract-tests |
Extract test cases to JSON |
pnpm dev |
Build and validate |
Rule Validation
The validator checks that each rule file has:
- Valid frontmatter with
titleandimpact - Main heading using
## - At least one
**Incorrect:**example with code - At least one
**Correct:**example with code - Valid impact level (CRITICAL, HIGH, MEDIUM, LOW)
Example Valid Rule
---
title: Prevent SQL Injection
impact: CRITICAL
tags: security, sql
---
## Prevent SQL Injection
Never concatenate user input into SQL queries.
**Incorrect (vulnerable):**
```python
query = f"SELECT * FROM users WHERE id = {user_id}"
Correct (parameterized):
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))
## Architecture
src/ ├── validate.ts # Rule file validation ├── build.ts # AGENTS.md compilation ├── extract-tests.ts # Test case extraction ├── parser.ts # Markdown parser for rules ├── types.ts # TypeScript type definitions └── config.ts # Configuration (paths, etc.)
## Configuration
Rules are read from: `../../skills/code-security/rules/`
Files starting with `_` are excluded (e.g., `_template.md`, `_sections.md`).
## Usage from Root
You can also use the Makefile from the repo root:
```bash
make validate # Runs pnpm validate
make build # Runs pnpm build
make zip # Creates skill zip package
make # All of the above
Development
# Run validation during development
pnpm dev
# Just validate
pnpm validate
# Full build
pnpm build