Nigel
/
CodeGuard
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove online and pro checks

This commit is contained in:
zhangxunhui 2026-03-18 14:09:10 +08:00
parent 3de9247445
commit fcda86991e
7 changed files with 10 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -136,6 +136,9 @@ CodeGuard/
- 在./installations/semgrep_offline/文件夹下打开powershell，运行`C:\Users\{username}\AppData\Local\Programs\Python\Python311\python.exe -m venv semgrep`命令（username需要替换为自己的用户名）。
- 删除./windows/install-all.bat中`Part 1: Semgrep Installation`的代码
- 再重新双击运行修改后的`install-all.bat`脚本
- 可能原因3：模型参数量太小对指令的理解能力较弱，出错后自行调整的能力也弱
- 模型必须具备function call的能力
- 建议使用30b以上的模型
## 兼容性问题

2
installations/semgrep-offline-rules/third-party/README.md vendored
View File

@ -7,8 +7,6 @@
Welcome! This repository contains [Semgrep's](https://semgrep.dev/) Community Edition rules.
In addition to the rules in this repository, the [Semgrep Registry](https://semgrep.dev/explore) offers proprietary [Pro rules](https://semgrep.dev/products/semgrep-code/pro-rules) that offer additional language coverage, and unlock crossfile and deep dataflow analysis.
- Find rules: search for Community Edition and Pro rules through the [Semgrep registry search](https://semgrep.dev/r).
- Use rules: Scan your code with these rules through [Semgrep AppSec Platform](https://semgrep.dev/login)
- Contribute to rules: see [Contributing to Semgrep rules](https://semgrep.dev/docs/contributing/contributing-to-semgrep-rules-repository/) for more information.

11
installations/semgrep_skill/SKILL.md
View File

@ -3,8 +3,7 @@ name: semgrep
description: >-
Run Semgrep static analysis scan on a codebase using parallel subagents.
Supports two scan modes — "run all" (full ruleset coverage) and "important
only" (high-confidence security vulnerabilities). Automatically detects and
uses Semgrep Pro for cross-file taint analysis when available. Use when asked
only" (high-confidence security vulnerabilities). Automatically detects. Use when asked
to scan code for vulnerabilities, run a security audit with Semgrep, find
bugs, or perform static analysis. Spawns parallel workers for multi-language
codebases.
@ -77,7 +76,6 @@ All semgrep commands in offline mode use these flags:
- Binary analysis → Use binary analysis tools
- Already have Semgrep CI configured → Use existing pipeline
- Need cross-file analysis but no Pro license → Consider CodeQL as alternative
- Creating custom Semgrep rules → Use `semgrep-rule-creator` skill
- Porting existing rules to other languages → Use `semgrep-rule-variant-creator` skill
@ -140,7 +138,7 @@ See [scan-modes.md](references/scan-modes.md) for metadata criteria and jq filte
```
┌──────────────────────────────────────────────────────────────────┐
│ MAIN AGENT (this skill) │
│ Step 1: Detect languages + check Pro availability │
│ Step 1: Detect languages │
│ Step 2: Select scan mode + rulesets (ref: rulesets.md) │
│ Step 3: Present plan + rulesets, get approval [⛔ HARD GATE] │
│ Step 4: Spawn parallel scan Tasks (approved rulesets + mode) │
@ -165,7 +163,7 @@ See [scan-modes.md](references/scan-modes.md) for metadata criteria and jq filte
| Step | Action | Gate | Key Reference |
|------|--------|------|---------------|
| 1 | Resolve output dir, detect languages + Pro availability | — | Use Glob, not Bash |
| 1 | Resolve output dir, detect languages | — | Use Glob, not Bash |
| 2 | Select scan mode + rulesets | — | [rulesets.md](references/rulesets.md) |
| 3 | Present plan, get explicit approval | ⛔ HARD | AskUserQuestion |
| 4 | Spawn parallel scan Tasks | — | [scanner-task-prompt.md](references/scanner-task-prompt.md) |
@ -199,7 +197,6 @@ Use `subagent_type: static-analysis:semgrep-scanner` in Step 4 when spawning Tas
| "Third-party rulesets are optional" | Trail of Bits, 0xdea, Decurity catch vulnerabilities not in official registry — REQUIRED |
| "Use --config auto" | Sends metrics; less control over rulesets |
| "One Task at a time" | Defeats parallelism; spawn all Tasks together |
| "Pro is too slow, skip --pro" | Cross-file analysis catches 250% more true positives; worth the time |
| "Semgrep handles GitHub URLs natively" | URL handling fails on repos with non-standard YAML; always clone first |
| "Cleanup is optional" | Cloned repos pollute the user's workspace and accumulate across runs |
| "Use `.` or relative path as target" | Subagents need absolute paths to avoid ambiguity |
@ -221,7 +218,7 @@ Use `subagent_type: static-analysis:semgrep-scanner` in Step 4 when spawning Tas
- [ ] Output directory resolved (user-specified or auto-incremented default)
- [ ] All generated files stored inside `$OUTPUT_DIR`
- [ ] Languages detected with file counts; Pro status checked
- [ ] Languages detected with file counts
- [ ] Scan mode selected by user (run all / important only)
- [ ] Rulesets include third-party rules for all detected languages
- [ ] User explicitly approved the scan plan (Step 3 gate passed)

59
installations/semgrep_skill/references/rulesets.md
View File

@ -72,13 +72,6 @@ For each detected language, add the primary ruleset. If a framework is detected,
| `.scala` | `p/scala` | - | Community |
| `.swift` | `p/swift` | - | 60+ |
**Beta Languages (Pro recommended):**
| Detection | Primary Ruleset | Notes |
|-----------|-----------------|-------|
| `.ex`, `.exs` | `p/elixir` | Requires Pro for best coverage |
| `.cls`, `.trigger` | `p/apex` | Salesforce; requires Pro |
**Experimental Languages:**
| Detection | Primary Ruleset | Notes |
@ -119,45 +112,10 @@ For each detected language, add the primary ruleset. If a framework is detected,
| `.yaml`, `.yml` | `p/yaml` | Generic YAML patterns (K8s, docker-compose) |
| AWS IAM JSON | `r/json.aws` | IAM policy misconfigurations (use `--config r/json.aws`) |
### Step 4: Add Third-Party Rulesets
These are **NOT optional**. Include automatically when language matches:
| Languages | Source | Why Required |
|-----------|--------|--------------|
| Python, Go, Ruby, JS/TS, Terraform, HCL | [Trail of Bits](https://github.com/trailofbits/semgrep-rules) | Security audit patterns from real engagements (AGPLv3) |
| C, C++ | [0xdea](https://github.com/0xdea/semgrep-rules) | Memory safety, low-level vulnerabilities |
| Solidity, Cairo, Rust | [Decurity](https://github.com/Decurity/semgrep-smart-contracts) | Smart contract vulnerabilities, DeFi exploits |
| Go | [dgryski](https://github.com/dgryski/semgrep-go) | Additional Go-specific patterns |
| Android (Java/Kotlin) | [MindedSecurity](https://github.com/mindedsecurity/semgrep-rules-android-security) | OWASP MASTG-derived mobile security rules |
| Java, Go, JS/TS, C#, Python, PHP | [elttam](https://github.com/elttam/semgrep-rules) | Security consulting patterns |
| Dockerfile, PHP, Go, Java | [kondukto](https://github.com/kondukto-io/semgrep-rules) | Container and web app security |
| PHP, Kotlin, Java | [dotta](https://github.com/federicodotta/semgrep-rules) | Pentest-derived web/mobile app rules |
| Terraform, HCL | [HashiCorp](https://github.com/hashicorp-forge/semgrep-rules) | HashiCorp infrastructure patterns |
| Swift, Java, Cobol | [akabe1](https://github.com/akabe1/akabe1-semgrep-rules) | iOS and legacy system patterns |
| Java | [Atlassian Labs](https://github.com/atlassian-labs/atlassian-sast-ruleset) | Atlassian-maintained Java rules |
| Python, JS/TS, Java, Ruby, Go, PHP | [Apiiro](https://github.com/apiiro/malicious-code-ruleset) | Malicious code detection, supply chain |
### Using Local Rules (Offline/Private Deployment)
For offline or private environments, use local rules instead of remote registry.
#### Configuration
Set the local rules path using environment variable:
```bash
# Windows
set SEMGREP_OFFLINE_RULES_PATH=C:\path\to\semgrep-offline-rules\third-party
set SEMGREP_OFFLINE=true
# Linux/Mac
export SEMGREP_OFFLINE_RULES_PATH=/path/to/semgrep-offline-rules/third-party
export SEMGREP_OFFLINE=true
```
The skill will automatically detect this variable and use local rules.
#### Option 1: Local Directory
```bash
@ -172,20 +130,7 @@ export SEMGREP_OFFLINE_RULES_PATH="/shared/rules"
semgrep scan # Will use local rules from the specified path
```
#### Downloading Rules for Offline Use
```bash
# Create offline rules package
mkdir -p /shared/semgrep-offline-rules
# Clone third-party rules (recommended)
git clone --depth 1 https://github.com/returntocorp/semgrep-rules /shared/semgrep-offline-rules/third-party
# Clone Trail of Bits rules
git clone --depth 1 https://github.com/trailofbits/semgrep-rules /shared/semgrep-offline-rules/third-party/tob
```
### Step 5: Verify Rulesets
### Step 4: Verify Rulesets
Before finalizing, verify official rulesets load:
@ -194,8 +139,6 @@ Before finalizing, verify official rulesets load:
semgrep --config p/python --validate --metrics=off 2>&1 | head -3
```
Or browse the [Semgrep Registry](https://semgrep.dev/explore).
### Output Format
```json

2
installations/semgrep_skill/references/scan-modes.md
View File

@ -102,7 +102,7 @@ done
In important-only mode, add `[SEVERITY_FLAGS]` to the scanner template:
```bash
semgrep [--pro if available] --metrics=off [SEVERITY_FLAGS] --config [RULESET] --json -o [OUTPUT_DIR]/raw/[lang]-[ruleset].json --sarif-output=[OUTPUT_DIR]/raw/[lang]-[ruleset].sarif [TARGET] &
semgrep --metrics=off [SEVERITY_FLAGS] --config [RULESET] --json -o [OUTPUT_DIR]/raw/[lang]-[ruleset].json --sarif-output=[OUTPUT_DIR]/raw/[lang]-[ruleset].sarif [TARGET] &
```
Where `[SEVERITY_FLAGS]` is:

4
installations/semgrep_skill/references/scanner-task-prompt.md
View File

@ -12,8 +12,6 @@ Run Semgrep scans for [LANGUAGE] files and save results to [OUTPUT_DIR]/raw.
## Mode: [SCAN_MODE: offline]
## Pro Engine Status: [PRO_AVAILABLE: true/false]
## Scan Mode: [SCAN_MODE: run-all/important-only]
## Rules Path: [RULES_PATH - local path]
@ -58,7 +56,6 @@ Report:
- Number of findings per ruleset
- Any scan errors
- File paths of JSON results (in [OUTPUT_DIR]/raw/)
- [If Pro] Note any cross-file findings detected
- [If Offline] Confirm offline mode was used
```
@ -70,7 +67,6 @@ Report:
| `[LANGUAGE]` | Specific language | Python, TypeScript, Go |
| `[OUTPUT_DIR]` | Output directory (absolute path, resolved in Step 1) | /path/to/static_analysis_semgrep_1 |
| `[SCAN_MODE]` | Scan mode | offline |
| `[PRO_AVAILABLE]` | Whether Pro engine is available | true, false |
| `[RULES_PATH]` | Local rules path for offline mode | C:\shared\semgrep-rules\third-party |
| `[SEVERITY_FLAGS]` | Severity pre-filter flags | *(empty)* for run-all, `--severity MEDIUM --severity HIGH --severity CRITICAL` for important-only |
| `[INCLUDE_FLAGS]` | File extension filter for language-specific rulesets | `--include="*.py"` for Python rulesets, *(empty)* for cross-language rulesets like p/security-audit, p/secrets, or third-party repos |

2
installations/semgrep_skill/workflows/scan-workflow.md
View File

@ -7,7 +7,7 @@ Complete 5-step scan execution process. Read from start to finish and follow eac
On invocation, create these tasks with dependencies:
```
TaskCreate: "Detect languages and Pro availability" (Step 1)
TaskCreate: "Detect languages" (Step 1)
TaskCreate: "Select scan mode and rulesets" (Step 2) - blockedBy: Step 1
TaskCreate: "Present plan with rulesets, get approval" (Step 3) - blockedBy: Step 2
TaskCreate: "Execute scans with approved rulesets and mode" (Step 4) - blockedBy: Step 3