Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill semgrep-appsec-scannerEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Multi-agent collaboration plugin that spawns N parallel subagents competing on the same task via git worktree isolation. Agents work independently, results are evaluated by metric or LLM judge, and the best branch is merged. Use when: user wants multiple approaches tried in parallel — code optimization, content variation, research exploration, or any task that benefits from parallel competition. Requires: a git repo.
Design production-grade multi-agent orchestration systems. Covers five core patterns (sequential pipeline, parallel fan-out/fan-in, hierarchical delegation, event-driven, consensus), platform-specific implementations, handoff protocols, state management, error recovery, context window budgeting, and cost optimization.
App Store Optimization toolkit for researching keywords, optimizing metadata, and tracking mobile app performance on Apple App Store and Google Play Store.
Mostrando SKILL.md
Basado en la clasificación ocupacional SOC
| name | semgrep-appsec-scanner |
| description | 用于通过 Semgrep 执行应用安全 SAST、源码扫描、自定义规则、密钥流程和供应链依赖分析。 |
| zh_description | 用于通过 Semgrep 执行应用安全 SAST、源码扫描、自定义规则、密钥流程和供应链依赖分析。 |
| version | 1.0.0 |
| author | seaworld008 |
| source | in-house |
| source_url | |
| tags | [security, sast, semgrep, code-scanning, supply-chain, secrets, ci, appsec] |
| created_at | 2026-05-20 |
| updated_at | 2026-05-20 |
| quality | 4 |
| complexity | advanced |
Use this skill when the user asks for source-code vulnerability scanning, secure coding rule enforcement, custom SAST checks, secret scanning workflow design, or Semgrep Supply Chain dependency analysis.
Good trigger phrases:
Before scanning, inspect the repo:
rg --files | sed -n '1,120p'
Classify:
semgrep --version
If missing, recommend official installation. For one-off local scans, a package manager or containerized Semgrep run is usually enough.
semgrep scan --config auto
For stricter security-focused scans:
semgrep scan --config p/security-audit
semgrep scan --config p/owasp-top-ten
For JSON output:
semgrep scan --config auto --json --output semgrep-results.json
For SARIF:
semgrep scan --config auto --sarif --output semgrep-results.sarif
For each finding, record:
Prioritize:
Use custom rules when the project has a known unsafe wrapper or banned API:
rules:
- id: no-dangerous-shell
message: Avoid shell=True with interpolated input.
severity: ERROR
languages: [python]
patterns:
- pattern: subprocess.run($CMD, shell=True, ...)
Validate the rule with positive and negative examples before adding it to CI.
For code fixes:
For dependency findings:
name: semgrep
on: [pull_request]
jobs:
semgrep:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Semgrep scan
run: semgrep scan --config auto --error
.semgrep/
rules/
no-dangerous-shell.yml
no-raw-sql-wrapper.yml
tests/
no-dangerous-shell.py
## Semgrep Finding
- Rule:
- Severity:
- Location:
- User input source:
- Sensitive sink:
- Exploit path:
- Fix:
- Test:
- Suppression status: