菜单
Author custom Semgrep rules on the fly to hunt for patterns specific to the current audit. Drops the rule into rules/semgrep/ and runs it against target/. Useful for variant analysis and for codifying a manual finding.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | semgrep-rule-creator |
| description | Author custom Semgrep rules on the fly to hunt for patterns specific to the current audit. Drops the rule into rules/semgrep/ and runs it against target/. Useful for variant analysis and for codifying a manual finding. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/semgrep-rule-creator |
# rules/semgrep/<slug>.yml
rules:
- id: <org>.<slug>
message: <one-line impact statement>
severity: ERROR # or WARNING
languages: [python] # or [javascript, typescript], etc.
metadata:
category: security
cwe: "CWE-78"
confidence: HIGH
references:
- <CVE or blog URL>
pattern-either:
- pattern: os.system($CMD)
- pattern: subprocess.call($CMD, shell=True)
pattern-not:
- pattern: os.system("static string")
Key knobs:
pattern, patterns (AND), pattern-either (OR), pattern-not, pattern-insidemetavariable-regex to narrow e.g. $CMD to user-controlled namespattern-sources + pattern-sinks for taint moderules:
- id: zonova.nodejs-cmd-injection
message: User-controlled input reaches child_process.exec
severity: ERROR
languages: [javascript, typescript]
mode: taint
pattern-sources:
- pattern: req.body
- pattern: req.query
- pattern: req.params
- pattern: req.headers
pattern-sinks:
- pattern: child_process.exec($X)
- pattern: child_process.execSync($X)
pattern-sanitizers:
- pattern: shellEscape($X)
# 1. Write rule
$EDITOR rules/semgrep/zonova-<slug>.yml
# 2. Smoke test on a small folder
semgrep --config rules/semgrep/zonova-<slug>.yml target/ --severity ERROR
# 3. Merge into the SAST run
semgrep --config rules/semgrep/ --sarif --output reports/sast-custom.sarif target/
eval" catches.pattern-not for known-safe wrappers in this codebase.metadata.references — it helps triage.rules/semgrep/ — it becomes part of the audit artefact.