[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DBWGGD4B90G1J9EAGK38F6":3,"skill-same:01M6DBWGGD4B90G1J9EAGK38F6":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":14,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":53,"install":54,"resources":67},"01M6DBWGGD4B90G1J9EAGK38F6","semgrep",null,"Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', or 'audit this code' - even without naming Semgrep. Pattern-based scanning across 30+ languages.","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsemgrep\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[5,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"Rules","across","pattern","scan","patterns","bug","scanning","use","write","ask","security","analysis","audit","code","run","create","scan code","code quality","static analysis","2026-11-10 10:12:30",false,"---\nname: semgrep\ndescription: \"Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', or 'audit this code' - even without naming Semgrep. Pattern-based scanning across 30+ languages.\"\n---\n\n# Semgrep Static Analysis\n\nFast, pattern-based static analysis for security scanning and custom rule creation.\n\n## MCP Tools Available\n\nIf Semgrep MCP tools are available in your environment, prefer them for scanning:\n\n- **`semgrep_scan`** — Scan code files for security vulnerabilities using built-in rulesets. Pass absolute file paths and an optional config (e.g., `p\u002Fsecurity-audit`, `auto`).\n- **`semgrep_scan_with_custom_rule`** — Scan code with a custom YAML rule you've written. Pass code content inline along with the rule.\n- **`semgrep_findings`** — Fetch existing findings from the Semgrep AppSec Platform for a repository.\n- **`semgrep_rule_schema`** — Get the full schema for writing Semgrep rules.\n- **`get_supported_languages`** — List all languages Semgrep supports.\n\nWhen MCP tools aren't available, fall back to the CLI commands below.\n\n## When to Use Semgrep\n\n**Ideal scenarios:**\n- Quick security scans (minutes, not hours)\n- Pattern-based bug and vulnerability detection\n- Enforcing coding standards and best practices\n- Finding known vulnerability patterns (OWASP, CWE)\n- Creating custom detection rules for your codebase\n- Data flow analysis with taint mode\n\n## Installation (CLI)\n\n```bash\n# pip (recommended)\npython3 -m pip install semgrep\n\n# Homebrew\nbrew install semgrep\n\n# Docker\ndocker run --rm -v \"${PWD}:\u002Fsrc\" semgrep\u002Fsemgrep semgrep --config auto \u002Fsrc\n```\n\n---\n\n# Part 1: Running Scans\n\n## Quick Scan\n\n```bash\nsemgrep --config auto .                    # Auto-detect rules\n```\n\n## Using Rulesets\n\n```bash\nsemgrep --config p\u002F\u003CRULESET> .             # Single ruleset\nsemgrep --config p\u002Fsecurity-audit --config p\u002Ftrailofbits .  # Multiple\n```\n\n| Ruleset | Description |\n|---------|-------------|\n| `p\u002Fdefault` | General security and code quality |\n| `p\u002Fsecurity-audit` | Comprehensive security rules |\n| `p\u002Fowasp-top-ten` | OWASP Top 10 vulnerabilities |\n| `p\u002Fcwe-top-25` | CWE Top 25 vulnerabilities |\n| `p\u002Ftrailofbits` | Trail of Bits security rules |\n| `p\u002Fpython` | Python-specific |\n| `p\u002Fjavascript` | JavaScript-specific |\n| `p\u002Fgolang` | Go-specific |\n\n## Output Formats\n\n```bash\nsemgrep --config p\u002Fsecurity-audit --sarif -o results.sarif .   # SARIF\nsemgrep --config p\u002Fsecurity-audit --json -o results.json .     # JSON\n```\n\n## Scan Specific Paths\n\n```bash\nsemgrep --config p\u002Fpython app.py           # Single file\nsemgrep --config p\u002Fjavascript src\u002F         # Directory\nsemgrep --config auto --include='**\u002Ftest\u002F**' .  # Include tests\n```\n\n## Configuration\n\n### .semgrepignore\n\n```\ntests\u002Ffixtures\u002F\n**\u002Ftestdata\u002F\ngenerated\u002F\nvendor\u002F\nnode_modules\u002F\n```\n\n### Suppress False Positives\n\n```python\npassword = get_from_vault()  # nosemgrep: hardcoded-password\ndangerous_but_safe()  # nosemgrep\n```\n\n---\n\n# Part 2: Creating Custom Rules\n\n## When to Create Custom Rules\n\n- Detecting project-specific vulnerability patterns\n- Enforcing internal coding standards\n- Building security checks for custom frameworks\n- Creating taint-mode rules for data flow analysis\n\n## Approach Selection\n\n| Approach | Use When |\n|----------|----------|\n| **Taint mode** | Data flows from untrusted source to dangerous sink (injection vulnerabilities) |\n| **Pattern matching** | Syntactic patterns without data flow requirements (deprecated APIs, hardcoded values) |\n\n**Prioritize taint mode** for injection vulnerabilities. Pattern matching alone can't distinguish between `eval(user_input)` (vulnerable) and `eval(\"safe_literal\")` (safe).\n\n## Quick Start: Pattern Matching\n\n```yaml\nrules:\n  - id: hardcoded-password\n    languages: [python]\n    message: \"Hardcoded password detected: $PASSWORD\"\n    severity: ERROR\n    pattern: password = \"$PASSWORD\"\n```\n\n## Quick Start: Taint Mode\n\n```yaml\nrules:\n  - id: command-injection\n    languages: [python]\n    message: User input flows to command execution\n    severity: ERROR\n    mode: taint\n    pattern-sources:\n      - pattern: request.args.get(...)\n      - pattern: request.form[...]\n    pattern-sinks:\n      - pattern: os.system(...)\n      - pattern: subprocess.call($CMD, shell=True, ...)\n    pattern-sanitizers:\n      - pattern: shlex.quote(...)\n```\n\n## Pattern Syntax Quick Reference\n\n| Syntax | Description | Example |\n|--------|-------------|---------|\n| `...` | Match anything | `func(...)` |\n| `$VAR` | Capture metavariable | `$FUNC($INPUT)` |\n| `\u003C... ...>` | Deep expression match | `\u003C... user_input ...>` |\n\n| Operator | Description |\n|----------|-------------|\n| `pattern` | Match exact pattern |\n| `patterns` | All must match (AND) |\n| `pattern-either` | Any matches (OR) |\n| `pattern-not` | Exclude matches |\n| `pattern-inside` | Match only inside context |\n| `pattern-not-inside` | Match only outside context |\n| `metavariable-regex` | Regex on captured value |\n\n## Testing Rules\n\n**Test-first is mandatory.** Create test files with annotations:\n\n```python\n# test_rule.py\ndef test_vulnerable():\n    user_input = request.args.get(\"id\")\n    # ruleid: my-rule-id\n    cursor.execute(\"SELECT * FROM users WHERE id = \" + user_input)\n\ndef test_safe():\n    user_input = request.args.get(\"id\")\n    # ok: my-rule-id\n    cursor.execute(\"SELECT * FROM users WHERE id = ?\", (user_input,))\n```\n\nRun tests:\n```bash\nsemgrep --test --config rule.yaml test-file\n```\n\n## Command Reference\n\n| Task | Command |\n|------|---------|\n| Run tests | `semgrep --test --config rule.yaml test-file` |\n| Validate YAML | `semgrep --validate --config rule.yaml` |\n| Dump AST | `semgrep --dump-ast -l \u003Clang> \u003Cfile>` |\n| Debug taint flow | `semgrep --dataflow-traces -f rule.yaml file` |\n\n## Rule Creation Workflow\n\n1. **Analyze the problem** - Understand the bug pattern, determine taint vs pattern approach\n2. **Create test cases first** - Write `ruleid:` and `ok:` annotations before the rule\n3. **Analyze AST** - Run `semgrep --dump-ast` to understand code structure\n4. **Write the rule** - Start simple, iterate\n5. **Test until 100% pass** - No \"missed lines\" or \"incorrect lines\"\n6. **Optimize patterns** - Remove redundancies only after tests pass\n\n**Output structure:**\n```\n\u003Crule-id>\u002F\n├── \u003Crule-id>.yaml     # Semgrep rule\n└── \u003Crule-id>.\u003Cext>    # Test file\n```\n\n## Detailed References\n\n**Official Semgrep Documentation:**\n- [Rule Syntax](https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002Fwriting-rules\u002Frule-syntax) - Complete YAML structure, operators, and options\n- [Rule Schema](https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fsemgrep-interfaces\u002Fblob\u002Fmain\u002Frule_schema_v1.yaml) - Full JSON schema specification\n\n**Local References:**\n- [Workflow Guide](references\u002Fworkflow.md) - Complete step-by-step rule creation process\n- [Quick Reference](references\u002Fquick-reference.md) - Pattern operators and taint components\n\n## Anti-Patterns to Avoid\n\n**Too broad:**\n```yaml\n# BAD: Matches any function call\npattern: $FUNC(...)\n\n# GOOD: Specific dangerous function\npattern: eval(...)\n```\n\n**Missing safe cases:**\n```python\n# BAD: Only tests vulnerable case\n# ruleid: my-rule\ndangerous(user_input)\n\n# GOOD: Include safe cases\n# ruleid: my-rule\ndangerous(user_input)\n\n# ok: my-rule\ndangerous(sanitize(user_input))\n```\n\n## Rationalizations to Reject\n\n| Shortcut | Why It's Wrong |\n|----------|----------------|\n| \"Semgrep found nothing, code is clean\" | Semgrep is pattern-based; can't track complex cross-function data flow |\n| \"The pattern looks complete\" | Untested rules have hidden false positives\u002Fnegatives |\n| \"It matches the vulnerable case\" | Matching vulnerabilities is half the job; verify safe cases don't match |\n| \"Taint mode is overkill\" | For injection vulnerabilities, taint mode gives better precision |\n| \"One test case is enough\" | Include edge cases: different coding styles, sanitized inputs, safe alternatives |\n\n---\n\n# CI\u002FCD Integration\n\n## GitHub Actions\n\n```yaml\nname: Semgrep\n\non:\n  push:\n    branches: [main]\n  pull_request:\n  schedule:\n    - cron: '0 0 1 * *'\n\njobs:\n  semgrep:\n    runs-on: ubuntu-latest\n    container:\n      image: returntocorp\u002Fsemgrep\n\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0\n\n      - name: Run Semgrep\n        run: |\n          if [ \"${{ github.event_name }}\" = \"pull_request\" ]; then\n            semgrep ci --baseline-commit ${{ github.event.pull_request.base.sha }}\n          else\n            semgrep ci\n          fi\n        env:\n          SEMGREP_RULES: >-\n            p\u002Fsecurity-audit\n            p\u002Fowasp-top-ten\n            p\u002Ftrailofbits\n```\n\n---\n\n# Resources\n\n**Rule Writing:**\n- Rule Syntax: https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002Fwriting-rules\u002Frule-syntax\n- Pattern Syntax: https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002Fwriting-rules\u002Fpattern-syntax\n- Rule Schema: https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fsemgrep-interfaces\u002Fblob\u002Fmain\u002Frule_schema_v1.yaml\n\n**General:**\n- Registry: https:\u002F\u002Fsemgrep.dev\u002Fexplore\n- Playground: https:\u002F\u002Fsemgrep.dev\u002Fplayground\n- Docs: https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002F\n- Trail of Bits Rules: https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fsemgrep-rules\n","# Semgrep Static Analysis\n\nFast, pattern-based static analysis for security scanning and custom rule creation.\n\n## MCP Tools Available\n\nIf Semgrep MCP tools are available in your environment, prefer them for scanning:\n\n- **`semgrep_scan`** — Scan code files for security vulnerabilities using built-in rulesets. Pass absolute file paths and an optional config (e.g., `p\u002Fsecurity-audit`, `auto`).\n- **`semgrep_scan_with_custom_rule`** — Scan code with a custom YAML rule you've written. Pass code content inline along with the rule.\n- **`semgrep_findings`** — Fetch existing findings from the Semgrep AppSec Platform for a repository.\n- **`semgrep_rule_schema`** — Get the full schema for writing Semgrep rules.\n- **`get_supported_languages`** — List all languages Semgrep supports.\n\nWhen MCP tools aren't available, fall back to the CLI commands below.\n\n## When to Use Semgrep\n\n**Ideal scenarios:**\n- Quick security scans (minutes, not hours)\n- Pattern-based bug and vulnerability detection\n- Enforcing coding standards and best practices\n- Finding known vulnerability patterns (OWASP, CWE)\n- Creating custom detection rules for your codebase\n- Data flow analysis with taint mode\n\n## Installation (CLI)\n\n```bash\n# pip (recommended)\npython3 -m pip install semgrep\n\n# Homebrew\nbrew install semgrep\n\n# Docker\ndocker run --rm -v \"${PWD}:\u002Fsrc\" semgrep\u002Fsemgrep semgrep --config auto \u002Fsrc\n```\n\n---\n\n# Part 1: Running Scans\n\n## Quick Scan\n\n```bash\nsemgrep --config auto .                    # Auto-detect rules\n```\n\n## Using Rulesets\n\n```bash\nsemgrep --config p\u002F\u003CRULESET> .             # Single ruleset\nsemgrep --config p\u002Fsecurity-audit --config p\u002Ftrailofbits .  # Multiple\n```\n\n| Ruleset | Description |\n|---------|-------------|\n| `p\u002Fdefault` | General security and code quality |\n| `p\u002Fsecurity-audit` | Comprehensive security rules |\n| `p\u002Fowasp-top-ten` | OWASP Top 10 vulnerabilities |\n| `p\u002Fcwe-top-25` | CWE Top 25 vulnerabilities |\n| `p\u002Ftrailofbits` | Trail of Bits security rules |\n| `p\u002Fpython` | Python-specific |\n| `p\u002Fjavascript` | JavaScript-specific |\n| `p\u002Fgolang` | Go-specific |\n\n## Output Formats\n\n```bash\nsemgrep --config p\u002Fsecurity-audit --sarif -o results.sarif .   # SARIF\nsemgrep --config p\u002Fsecurity-audit --json -o results.json .     # JSON\n```\n\n## Scan Specific Paths\n\n```bash\nsemgrep --config p\u002Fpython app.py           # Single file\nsemgrep --config p\u002Fjavascript src\u002F         # Directory\nsemgrep --config auto --include='**\u002Ftest\u002F**' .  # Include tests\n```\n\n## Configuration\n\n### .semgrepignore\n\n```\ntests\u002Ffixtures\u002F\n**\u002Ftestdata\u002F\ngenerated\u002F\nvendor\u002F\nnode_modules\u002F\n```\n\n### Suppress False Positives\n\n```python\npassword = get_from_vault()  # nosemgrep: hardcoded-password\ndangerous_but_safe()  # nosemgrep\n```\n\n---\n\n# Part 2: Creating Custom Rules\n\n## When to Create Custom Rules\n\n- Detecting project-specific vulnerability patterns\n- Enforcing internal coding standards\n- Building security checks for custom frameworks\n- Creating taint-mode rules for data flow analysis\n\n## Approach Selection\n\n| Approach | Use When |\n|----------|----------|\n| **Taint mode** | Data flows from untrusted source to dangerous sink (injection vulnerabilities) |\n| **Pattern matching** | Syntactic patterns without data flow requirements (deprecated APIs, hardcoded values) |\n\n**Prioritize taint mode** for injection vulnerabilities. Pattern matching alone can't distinguish between `eval(user_input)` (vulnerable) and `eval(\"safe_literal\")` (safe).\n\n## Quick Start: Pattern Matching\n\n```yaml\nrules:\n  - id: hardcoded-password\n    languages: [python]\n    message: \"Hardcoded password detected: $PASSWORD\"\n    severity: ERROR\n    pattern: password = \"$PASSWORD\"\n```\n\n## Quick Start: Taint Mode\n\n```yaml\nrules:\n  - id: command-injection\n    languages: [python]\n    message: User input flows to command execution\n    severity: ERROR\n    mode: taint\n    pattern-sources:\n      - pattern: request.args.get(...)\n      - pattern: request.form[...]\n    pattern-sinks:\n      - pattern: os.system(...)\n      - pattern: subprocess.call($CMD, shell=True, ...)\n    pattern-sanitizers:\n      - pattern: shlex.quote(...)\n```\n\n## Pattern Syntax Quick Reference\n\n| Syntax | Description | Example |\n|--------|-------------|---------|\n| `...` | Match anything | `func(...)` |\n| `$VAR` | Capture metavariable | `$FUNC($INPUT)` |\n| `\u003C... ...>` | Deep expression match | `\u003C... user_input ...>` |\n\n| Operator | Description |\n|----------|-------------|\n| `pattern` | Match exact pattern |\n| `patterns` | All must match (AND) |\n| `pattern-either` | Any matches (OR) |\n| `pattern-not` | Exclude matches |\n| `pattern-inside` | Match only inside context |\n| `pattern-not-inside` | Match only outside context |\n| `metavariable-regex` | Regex on captured value |\n\n## Testing Rules\n\n**Test-first is mandatory.** Create test files with annotations:\n\n```python\n# test_rule.py\ndef test_vulnerable():\n    user_input = request.args.get(\"id\")\n    # ruleid: my-rule-id\n    cursor.execute(\"SELECT * FROM users WHERE id = \" + user_input)\n\ndef test_safe():\n    user_input = request.args.get(\"id\")\n    # ok: my-rule-id\n    cursor.execute(\"SELECT * FROM users WHERE id = ?\", (user_input,))\n```\n\nRun tests:\n```bash\nsemgrep --test --config rule.yaml test-file\n```\n\n## Command Reference\n\n| Task | Command |\n|------|---------|\n| Run tests | `semgrep --test --config rule.yaml test-file` |\n| Validate YAML | `semgrep --validate --config rule.yaml` |\n| Dump AST | `semgrep --dump-ast -l \u003Clang> \u003Cfile>` |\n| Debug taint flow | `semgrep --dataflow-traces -f rule.yaml file` |\n\n## Rule Creation Workflow\n\n1. **Analyze the problem** - Understand the bug pattern, determine taint vs pattern approach\n2. **Create test cases first** - Write `ruleid:` and `ok:` annotations before the rule\n3. **Analyze AST** - Run `semgrep --dump-ast` to understand code structure\n4. **Write the rule** - Start simple, iterate\n5. **Test until 100% pass** - No \"missed lines\" or \"incorrect lines\"\n6. **Optimize patterns** - Remove redundancies only after tests pass\n\n**Output structure:**\n```\n\u003Crule-id>\u002F\n├── \u003Crule-id>.yaml     # Semgrep rule\n└── \u003Crule-id>.\u003Cext>    # Test file\n```\n\n## Detailed References\n\n**Official Semgrep Documentation:**\n- [Rule Syntax](https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002Fwriting-rules\u002Frule-syntax) - Complete YAML structure, operators, and options\n- [Rule Schema](https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fsemgrep-interfaces\u002Fblob\u002Fmain\u002Frule_schema_v1.yaml) - Full JSON schema specification\n\n**Local References:**\n- [Workflow Guide](references\u002Fworkflow.md) - Complete step-by-step rule creation process\n- [Quick Reference](references\u002Fquick-reference.md) - Pattern operators and taint components\n\n## Anti-Patterns to Avoid\n\n**Too broad:**\n```yaml\n# BAD: Matches any function call\npattern: $FUNC(...)\n\n# GOOD: Specific dangerous function\npattern: eval(...)\n```\n\n**Missing safe cases:**\n```python\n# BAD: Only tests vulnerable case\n# ruleid: my-rule\ndangerous(user_input)\n\n# GOOD: Include safe cases\n# ruleid: my-rule\ndangerous(user_input)\n\n# ok: my-rule\ndangerous(sanitize(user_input))\n```\n\n## Rationalizations to Reject\n\n| Shortcut | Why It's Wrong |\n|----------|----------------|\n| \"Semgrep found nothing, code is clean\" | Semgrep is pattern-based; can't track complex cross-function data flow |\n| \"The pattern looks complete\" | Untested rules have hidden false positives\u002Fnegatives |\n| \"It matches the vulnerable case\" | Matching vulnerabilities is half the job; verify safe cases don't match |\n| \"Taint mode is overkill\" | For injection vulnerabilities, taint mode gives better precision |\n| \"One test case is enough\" | Include edge cases: different coding styles, sanitized inputs, safe alternatives |\n\n---\n\n# CI\u002FCD Integration\n\n## GitHub Actions\n\n```yaml\nname: Semgrep\n\non:\n  push:\n    branches: [main]\n  pull_request:\n  schedule:\n    - cron: '0 0 1 * *'\n\njobs:\n  semgrep:\n    runs-on: ubuntu-latest\n    container:\n      image: returntocorp\u002Fsemgrep\n\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0\n\n      - name: Run Semgrep\n        run: |\n          if [ \"${{ github.event_name }}\" = \"pull_request\" ]; then\n            semgrep ci --baseline-commit ${{ github.event.pull_request.base.sha }}\n          else\n            semgrep ci\n          fi\n        env:\n          SEMGREP_RULES: >-\n            p\u002Fsecurity-audit\n            p\u002Fowasp-top-ten\n            p\u002Ftrailofbits\n```\n\n---\n\n# Resources\n\n**Rule Writing:**\n- Rule Syntax: https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002Fwriting-rules\u002Frule-syntax\n- Pattern Syntax: https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002Fwriting-rules\u002Fpattern-syntax\n- Rule Schema: https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fsemgrep-interfaces\u002Fblob\u002Fmain\u002Frule_schema_v1.yaml\n\n**General:**\n- Registry: https:\u002F\u002Fsemgrep.dev\u002Fexplore\n- Playground: https:\u002F\u002Fsemgrep.dev\u002Fplayground\n- Docs: https:\u002F\u002Fsemgrep.dev\u002Fdocs\u002F\n- Trail of Bits Rules: https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fsemgrep-rules\n",{"name":5,"description":7},"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5",".agents\u002Fskills\u002Fsemgrep","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill semgrep",{"tool":60,"command":61},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill semgrep",{"tool":63,"command":64},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill semgrep","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsemgrep\u002FSKILL.md",true,[68,74,78],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"README.md","REFERENCE","参考文档",3279,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsemgrep\u002FREADME.md",{"path":75,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fquick-reference.md",7255,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsemgrep\u002Freferences\u002Fquick-reference.md",{"path":79,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fworkflow.md",9186,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fsemgrep\u002Freferences\u002Fworkflow.md",[83,103,130,157,171,187],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":43},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[90,91,92,93,94,95,96,97,30,31,98,99,100,101,102],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","context","repo","injection","execution","file",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":110,"publishedAt":43},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[109],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[111,112,113,114,115,116,117,118,119,120,121,122,123,124,31,125,126,127,128,129],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","local","do","MCP",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":142,"publishedAt":43},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[136,139],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[143,144,145,146,147,148,149,150,151,152,112,153,154,155,156],"review","visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":43},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[159,164,165,166,167,168,169,170],"setup","report","project","installation","project setup","issues","state",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":178,"publishedAt":43},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[177],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[173,179,95,180,181,182,31,183,184,185,186],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":188,"name":164,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":192,"publishedAt":43},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[164,166,127,193,168,194],"files","interactive"]