Agent Skills
› mtarcure/claude-vibe-squad
› diff-aware-semgrep-scan
diff-aware-semgrep-scan
GitHub针对代码变更运行 Semgrep 静态扫描，通过指定基线提交和规则包过滤历史误报，聚焦新引入的安全风险。涵盖源到汇路径分析、误报归因及覆盖率报告，确保在大规模遗留代码库中精准识别新增漏洞。
Trigger Scenarios
审查特定代码变更时的安全分析
需要区分新旧安全问题的静态扫描任务
Install
npx skills add mtarcure/claude-vibe-squad --skill diff-aware-semgrep-scan -g -y
SKILL.md
Frontmatter
{
"name": "diff-aware-semgrep-scan",
"audience": "specialist",
"description": "Use when reviewing a particular code change against a large pre-existing Semgrep baseline: fix the base commit, choose rules by language and change shape, surface new or newly exposed source-to-sink paths, and report parse or coverage gaps. Route recurring false positives to semgrep-rule-author."
}
Diff-Aware Semgrep Scan
Scan only what changed, with the rules that matter for the change, so static-analysis signal survives contact with a large legacy baseline.
Steps
- Fix the comparison range (
git diff --name-only <base>...HEAD) and collect changed files plus their language mix. - Select rule packs by language and by change shape — auth, deserialization, templating, SQL, subprocess, crypto — rather than running one generic pack over everything.
- Run
semgrep --config <packs> --baseline-commit <base>so pre-existing findings are suppressed and only newly-introduced ones surface. - Re-run without the baseline flag on the changed files alone when a finding's history matters; a pre-existing issue in a file the change now exposes to untrusted input is a new risk even though the line is old.
- Triage every hit against
findings-filter: reachability from an untrusted source, attacker-controlled input, and real consequence. - For each true positive, capture the rule id, the file:line, the data path from source to sink, and the minimal fix.
- For each false positive, record why the rule misfired; recurring misfires are input to
semgrep-rule-author, not something to silence per-finding. - Report scan coverage honestly: files skipped for parse errors or unsupported languages are gaps, not passes.
Acceptance
- The scan states its base commit and the rule packs selected, with a reason for the selection.
- Newly-introduced findings are separated from pre-existing ones.
- Every reported finding has a source-to-sink path, not just a rule match.
- False positives are explained, and repeat offenders are routed to rule authoring.
- Unscanned or unparsed files are listed as coverage gaps.
Version History
- d5262e2 Current 2026-09-11 11:16
