testland/semgrep-rules
Configures and runs Semgrep - pattern-based SAST across 30+ languages with the Semgrep Registry rulesets (`p/owasp-top-ten`, `p/default`, `auto`) plus custom YAML rules; integrates `semgrep ci` for PR-blocking gates with `--baseline-commit` diff-aware scanning, per-finding inline `nosemgrep` suppressions, `--exclude` / `--include` path filters, output formats (`--json` / `--sarif` / `--gitlab-sast` / `--junit-xml`), and severity filter (INFO/WARNING/ERROR). Use when the user runs Semgrep, asks about pattern rules, or needs a low-friction SAST gate without semantic-DB setup.
76
95%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The runtime workflow described in SKILL.md executes `semgrep scan --config auto` / `semgrep scan --config p/...` which can auto-fetch and ingest Semgrep Registry ruleset content (outsider-authored community rules) into the LLM/service at runtime.
Where we found it
semgrep.dev
domain · 6 sites
The plugin instructs the agent to run `semgrep scan --config auto`, `--config p/...`, and `semgrep ci`, all of which fetch community-authored rulesets/policies from the Semgrep Registry (semgrep.dev) at runtime; the rule messages and metadata in scan output are then ingested by the LLM.
- Audited
- Security analysis