diff --git a/README.md b/README.md index 1a34644..b191efa 100644 --- a/README.md +++ b/README.md @@ -136,6 +136,9 @@ CodeGuard/ - 在./installations/semgrep_offline/文件夹下打开powershell，运行`C:\Users\{username}\AppData\Local\Programs\Python\Python311\python.exe -m venv semgrep`命令（username需要替换为自己的用户名）。 - 删除./windows/install-all.bat中`Part 1: Semgrep Installation`的代码 - 再重新双击运行修改后的`install-all.bat`脚本 + - 可能原因3：模型参数量太小对指令的理解能力较弱，出错后自行调整的能力也弱 + - 模型必须具备function call的能力 + - 建议使用30b以上的模型 ## 兼容性问题 diff --git a/installations/semgrep-offline-rules/third-party/README.md b/installations/semgrep-offline-rules/third-party/README.md index 598d343..c5b760b 100644 --- a/installations/semgrep-offline-rules/third-party/README.md +++ b/installations/semgrep-offline-rules/third-party/README.md @@ -7,8 +7,6 @@ Welcome! This repository contains [Semgrep's](https://semgrep.dev/) Community Edition rules. -In addition to the rules in this repository, the [Semgrep Registry](https://semgrep.dev/explore) offers proprietary [Pro rules](https://semgrep.dev/products/semgrep-code/pro-rules) that offer additional language coverage, and unlock crossfile and deep dataflow analysis. - - Find rules: search for Community Edition and Pro rules through the [Semgrep registry search](https://semgrep.dev/r). - Use rules: Scan your code with these rules through [Semgrep AppSec Platform](https://semgrep.dev/login) - Contribute to rules: see [Contributing to Semgrep rules](https://semgrep.dev/docs/contributing/contributing-to-semgrep-rules-repository/) for more information. diff --git a/installations/semgrep_skill/SKILL.md b/installations/semgrep_skill/SKILL.md index 3225b5b..5e64897 100644 --- a/installations/semgrep_skill/SKILL.md +++ b/installations/semgrep_skill/SKILL.md @@ -3,8 +3,7 @@ name: semgrep description: >- Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important - only" (high-confidence security vulnerabilities). Automatically detects and - uses Semgrep Pro for cross-file taint analysis when available. Use when asked + only" (high-confidence security vulnerabilities). Automatically detects. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases. @@ -77,7 +76,6 @@ All semgrep commands in offline mode use these flags: - Binary analysis → Use binary analysis tools - Already have Semgrep CI configured → Use existing pipeline -- Need cross-file analysis but no Pro license → Consider CodeQL as alternative - Creating custom Semgrep rules → Use `semgrep-rule-creator` skill - Porting existing rules to other languages → Use `semgrep-rule-variant-creator` skill @@ -140,7 +138,7 @@ See [scan-modes.md](references/scan-modes.md) for metadata criteria and jq filte ``` ┌──────────────────────────────────────────────────────────────────┐ │ MAIN AGENT (this skill) │ -│ Step 1: Detect languages + check Pro availability │ +│ Step 1: Detect languages │ │ Step 2: Select scan mode + rulesets (ref: rulesets.md) │ │ Step 3: Present plan + rulesets, get approval [⛔ HARD GATE] │ │ Step 4: Spawn parallel scan Tasks (approved rulesets + mode) │ @@ -165,7 +163,7 @@ See [scan-modes.md](references/scan-modes.md) for metadata criteria and jq filte | Step | Action | Gate | Key Reference | |------|--------|------|---------------| -| 1 | Resolve output dir, detect languages + Pro availability | — | Use Glob, not Bash | +| 1 | Resolve output dir, detect languages | — | Use Glob, not Bash | | 2 | Select scan mode + rulesets | — | [rulesets.md](references/rulesets.md) | | 3 | Present plan, get explicit approval | ⛔ HARD | AskUserQuestion | | 4 | Spawn parallel scan Tasks | — | [scanner-task-prompt.md](references/scanner-task-prompt.md) | @@ -199,7 +197,6 @@ Use `subagent_type: static-analysis:semgrep-scanner` in Step 4 when spawning Tas | "Third-party rulesets are optional" | Trail of Bits, 0xdea, Decurity catch vulnerabilities not in official registry — REQUIRED | | "Use --config auto" | Sends metrics; less control over rulesets | | "One Task at a time" | Defeats parallelism; spawn all Tasks together | -| "Pro is too slow, skip --pro" | Cross-file analysis catches 250% more true positives; worth the time | | "Semgrep handles GitHub URLs natively" | URL handling fails on repos with non-standard YAML; always clone first | | "Cleanup is optional" | Cloned repos pollute the user's workspace and accumulate across runs | | "Use `.` or relative path as target" | Subagents need absolute paths to avoid ambiguity | @@ -221,7 +218,7 @@ Use `subagent_type: static-analysis:semgrep-scanner` in Step 4 when spawning Tas - [ ] Output directory resolved (user-specified or auto-incremented default) - [ ] All generated files stored inside `$OUTPUT_DIR` -- [ ] Languages detected with file counts; Pro status checked +- [ ] Languages detected with file counts - [ ] Scan mode selected by user (run all / important only) - [ ] Rulesets include third-party rules for all detected languages - [ ] User explicitly approved the scan plan (Step 3 gate passed) diff --git a/installations/semgrep_skill/references/rulesets.md b/installations/semgrep_skill/references/rulesets.md index 9567313..c33e847 100644 --- a/installations/semgrep_skill/references/rulesets.md +++ b/installations/semgrep_skill/references/rulesets.md @@ -72,13 +72,6 @@ For each detected language, add the primary ruleset. If a framework is detected, | `.scala` | `p/scala` | - | Community | | `.swift` | `p/swift` | - | 60+ | -**Beta Languages (Pro recommended):** - -| Detection | Primary Ruleset | Notes | -|-----------|-----------------|-------| -| `.ex`, `.exs` | `p/elixir` | Requires Pro for best coverage | -| `.cls`, `.trigger` | `p/apex` | Salesforce; requires Pro | - **Experimental Languages:** | Detection | Primary Ruleset | Notes | @@ -119,45 +112,10 @@ For each detected language, add the primary ruleset. If a framework is detected, | `.yaml`, `.yml` | `p/yaml` | Generic YAML patterns (K8s, docker-compose) | | AWS IAM JSON | `r/json.aws` | IAM policy misconfigurations (use `--config r/json.aws`) | -### Step 4: Add Third-Party Rulesets - -These are **NOT optional**. Include automatically when language matches: - -| Languages | Source | Why Required | -|-----------|--------|--------------| -| Python, Go, Ruby, JS/TS, Terraform, HCL | [Trail of Bits](https://github.com/trailofbits/semgrep-rules) | Security audit patterns from real engagements (AGPLv3) | -| C, C++ | [0xdea](https://github.com/0xdea/semgrep-rules) | Memory safety, low-level vulnerabilities | -| Solidity, Cairo, Rust | [Decurity](https://github.com/Decurity/semgrep-smart-contracts) | Smart contract vulnerabilities, DeFi exploits | -| Go | [dgryski](https://github.com/dgryski/semgrep-go) | Additional Go-specific patterns | -| Android (Java/Kotlin) | [MindedSecurity](https://github.com/mindedsecurity/semgrep-rules-android-security) | OWASP MASTG-derived mobile security rules | -| Java, Go, JS/TS, C#, Python, PHP | [elttam](https://github.com/elttam/semgrep-rules) | Security consulting patterns | -| Dockerfile, PHP, Go, Java | [kondukto](https://github.com/kondukto-io/semgrep-rules) | Container and web app security | -| PHP, Kotlin, Java | [dotta](https://github.com/federicodotta/semgrep-rules) | Pentest-derived web/mobile app rules | -| Terraform, HCL | [HashiCorp](https://github.com/hashicorp-forge/semgrep-rules) | HashiCorp infrastructure patterns | -| Swift, Java, Cobol | [akabe1](https://github.com/akabe1/akabe1-semgrep-rules) | iOS and legacy system patterns | -| Java | [Atlassian Labs](https://github.com/atlassian-labs/atlassian-sast-ruleset) | Atlassian-maintained Java rules | -| Python, JS/TS, Java, Ruby, Go, PHP | [Apiiro](https://github.com/apiiro/malicious-code-ruleset) | Malicious code detection, supply chain | - ### Using Local Rules (Offline/Private Deployment) For offline or private environments, use local rules instead of remote registry. -#### Configuration - -Set the local rules path using environment variable: - -```bash -# Windows -set SEMGREP_OFFLINE_RULES_PATH=C:\path\to\semgrep-offline-rules\third-party -set SEMGREP_OFFLINE=true - -# Linux/Mac -export SEMGREP_OFFLINE_RULES_PATH=/path/to/semgrep-offline-rules/third-party -export SEMGREP_OFFLINE=true -``` - -The skill will automatically detect this variable and use local rules. - #### Option 1: Local Directory ```bash @@ -172,20 +130,7 @@ export SEMGREP_OFFLINE_RULES_PATH="/shared/rules" semgrep scan # Will use local rules from the specified path ``` -#### Downloading Rules for Offline Use - -```bash -# Create offline rules package -mkdir -p /shared/semgrep-offline-rules - -# Clone third-party rules (recommended) -git clone --depth 1 https://github.com/returntocorp/semgrep-rules /shared/semgrep-offline-rules/third-party - -# Clone Trail of Bits rules -git clone --depth 1 https://github.com/trailofbits/semgrep-rules /shared/semgrep-offline-rules/third-party/tob -``` - -### Step 5: Verify Rulesets +### Step 4: Verify Rulesets Before finalizing, verify official rulesets load: @@ -194,8 +139,6 @@ Before finalizing, verify official rulesets load: semgrep --config p/python --validate --metrics=off 2>&1 | head -3 ``` -Or browse the [Semgrep Registry](https://semgrep.dev/explore). - ### Output Format ```json diff --git a/installations/semgrep_skill/references/scan-modes.md b/installations/semgrep_skill/references/scan-modes.md index 2d9de70..0100185 100644 --- a/installations/semgrep_skill/references/scan-modes.md +++ b/installations/semgrep_skill/references/scan-modes.md @@ -102,7 +102,7 @@ done In important-only mode, add `[SEVERITY_FLAGS]` to the scanner template: ```bash -semgrep [--pro if available] --metrics=off [SEVERITY_FLAGS] --config [RULESET] --json -o [OUTPUT_DIR]/raw/[lang]-[ruleset].json --sarif-output=[OUTPUT_DIR]/raw/[lang]-[ruleset].sarif [TARGET] & +semgrep --metrics=off [SEVERITY_FLAGS] --config [RULESET] --json -o [OUTPUT_DIR]/raw/[lang]-[ruleset].json --sarif-output=[OUTPUT_DIR]/raw/[lang]-[ruleset].sarif [TARGET] & ``` Where `[SEVERITY_FLAGS]` is: diff --git a/installations/semgrep_skill/references/scanner-task-prompt.md b/installations/semgrep_skill/references/scanner-task-prompt.md index 7079f6b..57e482f 100644 --- a/installations/semgrep_skill/references/scanner-task-prompt.md +++ b/installations/semgrep_skill/references/scanner-task-prompt.md @@ -12,8 +12,6 @@ Run Semgrep scans for [LANGUAGE] files and save results to [OUTPUT_DIR]/raw. ## Mode: [SCAN_MODE: offline] -## Pro Engine Status: [PRO_AVAILABLE: true/false] - ## Scan Mode: [SCAN_MODE: run-all/important-only] ## Rules Path: [RULES_PATH - local path] @@ -58,7 +56,6 @@ Report: - Number of findings per ruleset - Any scan errors - File paths of JSON results (in [OUTPUT_DIR]/raw/) -- [If Pro] Note any cross-file findings detected - [If Offline] Confirm offline mode was used ``` @@ -70,7 +67,6 @@ Report: | `[LANGUAGE]` | Specific language | Python, TypeScript, Go | | `[OUTPUT_DIR]` | Output directory (absolute path, resolved in Step 1) | /path/to/static_analysis_semgrep_1 | | `[SCAN_MODE]` | Scan mode | offline | -| `[PRO_AVAILABLE]` | Whether Pro engine is available | true, false | | `[RULES_PATH]` | Local rules path for offline mode | C:\shared\semgrep-rules\third-party | | `[SEVERITY_FLAGS]` | Severity pre-filter flags | *(empty)* for run-all, `--severity MEDIUM --severity HIGH --severity CRITICAL` for important-only | | `[INCLUDE_FLAGS]` | File extension filter for language-specific rulesets | `--include="*.py"` for Python rulesets, *(empty)* for cross-language rulesets like p/security-audit, p/secrets, or third-party repos | diff --git a/installations/semgrep_skill/workflows/scan-workflow.md b/installations/semgrep_skill/workflows/scan-workflow.md index 3d26309..ed2827b 100644 --- a/installations/semgrep_skill/workflows/scan-workflow.md +++ b/installations/semgrep_skill/workflows/scan-workflow.md @@ -7,7 +7,7 @@ Complete 5-step scan execution process. Read from start to finish and follow eac On invocation, create these tasks with dependencies: ``` -TaskCreate: "Detect languages and Pro availability" (Step 1) +TaskCreate: "Detect languages" (Step 1) TaskCreate: "Select scan mode and rulesets" (Step 2) - blockedBy: Step 1 TaskCreate: "Present plan with rulesets, get approval" (Step 3) - blockedBy: Step 2 TaskCreate: "Execute scans with approved rulesets and mode" (Step 4) - blockedBy: Step 3