Skill UI

This guide details how to integrate Static Application Security Testing (SAST) tools like CodeQL and Semgrep into your CI/CD pipelines using GitHub Actions. It covers setting up automated vulnerability detection on pull requests, tuning rules to minimize false positives, uploading SARIF results for centralized security reporting, and enforcing quality gates to prevent vulnerable code from merging into protected branches. Essential for DevSecOps and compliance (SOC 2, PCI DSS).

A comprehensive white-box security auditing workflow designed for proprietary source code. It integrates static analysis security testing (SAST) tools like Semgrep and CodeQL to detect common vulnerabilities (e.g., injection, IDOR, crypto misuse), followed by mandatory manual threat modeling and verification steps. Applicable for PR reviews and pre-deployment security checks.

Perform authorized static analysis on source code to identify security vulnerabilities using tools like Semgrep and CodeQL. This workflow covers pattern hunting, dangerous API detection, and verification of vulnerability fixes. Essential for white-box audits and PR security reviews.

Expert AI-powered code review combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverages tools like GitHub Copilot, SonarQube, CodeQL, and Semgrep to identify bugs, vulnerabilities, and performance issues across 30+ languages, integrated with CI/CD pipelines for instant PR feedback.

This skill covers the setup and configuration of Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL. It guides users on creating custom security rules, integrating scans into CI/CD pipelines, and managing quality gates. The process includes optimizing scan performance, reducing false positives, and ensuring compliance with security policies across multiple programming languages.

Perform static application security testing to identify vulnerabilities in source code before deployment. Use tools like Semgrep, CodeQL, and SonarQube to integrate security gates into CI/CD pipelines and ensure compliance with secure SDLC practices.

This skill creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. It guides users through a strict workflow including test-first development, AST analysis, and validation. Ideal for building static analysis detections, enforcing coding standards, and identifying data flow issues using taint mode.

Creates language-specific variants of existing Semgrep rules. Use when porting a rule to target languages, with applicability analysis and test-driven validation for each language.

Finds similar vulnerabilities and bugs across codebases using pattern-based analysis. Ideal for hunting bug variants, building CodeQL/Semgrep queries, analyzing security issues, and systematic code audits after an initial discovery.