Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill semgrep-appsec-scannerThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Multi-agent collaboration plugin that spawns N parallel subagents competing on the same task via git worktree isolation. Agents work independently, results are evaluated by metric or LLM judge, and the best branch is merged. Use when: user wants multiple approaches tried in parallel — code optimization, content variation, research exploration, or any task that benefits from parallel competition. Requires: a git repo.
Design production-grade multi-agent orchestration systems. Covers five core patterns (sequential pipeline, parallel fan-out/fan-in, hierarchical delegation, event-driven, consensus), platform-specific implementations, handoff protocols, state management, error recovery, context window budgeting, and cost optimization.
App Store Optimization toolkit for researching keywords, optimizing metadata, and tracking mobile app performance on Apple App Store and Google Play Store.
Based on SOC occupation classification
Showing SKILL.md
| name | semgrep-appsec-scanner |
| description | 用于通过 Semgrep 执行应用安全 SAST、源码扫描、自定义规则、密钥流程和供应链依赖分析。 |
| zh_description | 用于通过 Semgrep 执行应用安全 SAST、源码扫描、自定义规则、密钥流程和供应链依赖分析。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, sast, semgrep, code-scanning, supply-chain, secrets, ci, appsec] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | advanced |
Use this skill when the user asks for source-code vulnerability scanning, secure coding rule enforcement, custom SAST checks, secret scanning workflow design, or Semgrep Supply Chain dependency analysis.
Good trigger phrases:
Before scanning, inspect the repo:
rg --files | sed -n '1,120p'
Classify:
semgrep --version
If missing, recommend official installation. For one-off local scans, a package manager or containerized Semgrep run is usually enough.
semgrep scan --config auto
For stricter security-focused scans:
semgrep scan --config p/security-audit
semgrep scan --config p/owasp-top-ten
For JSON output:
semgrep scan --config auto --json --output semgrep-results.json
For SARIF:
semgrep scan --config auto --sarif --output semgrep-results.sarif
For each finding, record:
Prioritize:
Use custom rules when the project has a known unsafe wrapper or banned API:
rules:
- id: no-dangerous-shell
message: Avoid shell=True with interpolated input.
severity: ERROR
languages: [python]
patterns:
- pattern: subprocess.run($CMD, shell=True, ...)
Validate the rule with positive and negative examples before adding it to CI.
For code fixes:
For dependency findings:
name: semgrep
on: [pull_request]
jobs:
semgrep:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Semgrep scan
run: semgrep scan --config auto --error
.semgrep/
rules/
no-dangerous-shell.yml
no-raw-sql-wrapper.yml
tests/
no-dangerous-shell.py
## Semgrep Finding
- Rule:
- Severity:
- Location:
- User input source:
- Sensitive sink:
- Exploit path:
- Fix:
- Test:
- Suppression status: