菜单
Compare opengrep scan findings between current and base branch rules to detect new/removed findings. Use when the user wants to evaluate the impact of rule changes.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Auto-detect top maintainers for each repo in an org and set the maintainers custom property via the GitHub API. Use when the user wants to populate or update maintainer metadata.
Validate metadata fields (author, source, category) in opengrep/semgrep YAML rule files. Use when the user wants to lint or check rule quality.
Clean up stale security-action Slack messages based on review signals (reactions, label removal, resolved threads). Use when the user wants to clean old notifications from a Slack channel.
Delete Slack messages from a channel filtered by bot username and repository names. Use when the user wants to bulk-delete bot messages for specific repos.
Auto-dismiss Dependabot alerts matching configurable hotwords (e.g. DoS) or a GHSA/CVE dismiss list. Use when the user wants to bulk-dismiss low-priority Dependabot alerts.
Scan org repos for open Dependabot alerts at or above a severity threshold and build notification messages for maintainers. Use when the user wants to check or nudge about Dependabot vulnerabilities.
| name | opengrep-compare |
| description | Compare opengrep scan findings between current and base branch rules to detect new/removed findings. Use when the user wants to evaluate the impact of rule changes. |
| argument-hint | [target-repo or local-target] |
| allowed-tools | Bash(node *) |
Compare opengrep scan findings between the current branch's rules and a base branch's rules to compute a delta.
Run from the project root:
# Compare against a remote repo
node run.js ./src/opengrepCompare.js --target-repo=brave/brave-browser
# Compare against a subdirectory of a remote repo
node run.js ./src/opengrepCompare.js --target-repo=brave/brave-browser --target-path=browser/
# Compare against a local directory
node run.js ./src/opengrepCompare.js --local-target=/path/to/codebase
# Custom base branch
node run.js ./src/opengrepCompare.js --target-repo=brave/brave-browser --base-ref=develop
# Only scan changed rules
node run.js ./src/opengrepCompare.js --target-repo=brave/brave-browser --changed-rules-only=true
| Parameter | Required | Default | Description |
|---|---|---|---|
--target-repo | No* | - | GitHub repo to clone and scan (e.g. org/repo) |
--target-path | No | - | Subdirectory within the target repo to scan |
--local-target | No* | - | Local filesystem path to scan instead of cloning |
--base-ref | No | main | Git ref for base branch comparison |
--compare-rules | No | true | Whether to run base-branch comparison |
--changed-rules-only | No | true | Only scan rule files changed between branches |
* One of --target-repo or --local-target is required.
Returns a JSON object with:
total: Total findings countrules: Number of rules scannedsummary: Per-rule finding countsfindings: All individual findingsdelta: New and removed findings vs. base branchpercentageIncrease: Finding count change percentagebaseTotal: Base branch findings countnoChanges: Boolean indicating if no rule changes were detectedopengrep CLI must be installed and on PATHrun.js entry point automatically loads .env credentialsgit diff to detect changed rule files between branchesinstallOpengrep.js or install manually)