admin/trailofbits-skills
1
0
Fork 0
mirror of https://github.com/trailofbits/skills synced 2026-06-21 14:12:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into trailmark-0.4

Browse Source
This commit is contained in:
Scott Arciszewski
2026-06-10 16:12:41 -04:00
committed by GitHub
parent bfcf747c5e c070b9b588
commit 0e3ac86d86
10 changed files with 27 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude-plugin/marketplace.json
+3 -3
View File
@@ -168,7 +168,7 @@
},
{
"name": "semgrep-rule-creator",
"version": "1.2.1",
"version": "1.2.2",
"description": "Create custom Semgrep rules for detecting bug patterns and security vulnerabilities",
"author": {
"name": "Maciej Domanski"
@@ -275,7 +275,7 @@
},
{
"name": "second-opinion",
"version": "1.6.1",
"version": "1.7.0",
"description": "Runs code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits. Bundles Codex's built-in MCP server for direct tool access.",
"author": {
"name": "Dan Guido"
@@ -375,7 +375,7 @@
},
{
"name": "fp-check",
"version": "1.0.1",
"version": "1.0.2",
"description": "Systematic false positive verification for security bug analysis with mandatory gate reviews",
"author": {
"name": "Maciej Domanski"
.github/workflows/lint.yml
+3 -3
View File
@@ -18,7 +18,7 @@ jobs:
name: Pre-commit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -30,7 +30,7 @@ jobs:
name: Shell (bats)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- name: Install bats and uv
@@ -46,7 +46,7 @@ jobs:
name: Python tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
.github/workflows/validate.yml
+1 -1
View File
@@ -18,7 +18,7 @@ jobs:
name: Validate plugins and skills
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
persist-credentials: false
plugins/fp-check/.claude-plugin/plugin.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "fp-check",
"version": "1.0.1",
"version": "1.0.2",
"description": "Systematic false positive verification for security bug analysis with mandatory gate reviews",
"author": {
"name": "Maciej Domanski"
plugins/fp-check/hooks/hooks.json
+2 -2
View File
@@ -7,7 +7,7 @@
"hooks": [
{
"type": "prompt",
"prompt": "You are a verification completeness checker for the fp-check false positive analysis skill. The agent is about to stop. Check whether the verification process was completed properly.\n\nScan the conversation for evidence of ALL of the following for EVERY bug that was being verified:\n\n1. Phase 1 (Data Flow Analysis): Trust boundaries mapped, API contracts checked, environment protections analyzed, cross-references checked\n2. Phase 2 (Exploitability Verification): Attacker control confirmed or denied, mathematical bounds analyzed (or marked N/A), race conditions analyzed (or marked N/A), adversarial analysis completed\n3. Phase 3 (Impact Assessment): Real security impact vs operational robustness distinguished, primary controls vs defense-in-depth distinguished\n4. Phase 4 (PoC Creation): Pseudocode PoC created, executable/unit test PoCs created or explicitly skipped with justification, negative PoC created, PoC verification completed\n5. Phase 5 (Devil's Advocate): All 13 challenge questions addressed\n6. Gate Review: All 6 gates (Process, Reachability, Real Impact, PoC Validation, Math Bounds, Environment) evaluated with pass/fail\n7. Verdict: Each bug has a TRUE POSITIVE or FALSE POSITIVE verdict with evidence\n\nIf ANY bug is missing ANY of these phases or the gate review, return 'block' with the specific gaps.\nIf all bugs have complete verification with verdicts, return 'approve'.\nIf the conversation is not about fp-check verification at all, return 'approve'.",
"prompt": "You are a verification completeness checker for the fp-check false positive analysis skill. The agent is about to stop. Check whether the verification process was completed properly.\n\nScan the conversation for evidence of ALL of the following for EVERY bug that was being verified:\n\n1. Phase 1 (Data Flow Analysis): Trust boundaries mapped, API contracts checked, environment protections analyzed, cross-references checked\n2. Phase 2 (Exploitability Verification): Attacker control confirmed or denied, mathematical bounds analyzed (or marked N/A), race conditions analyzed (or marked N/A), adversarial analysis completed\n3. Phase 3 (Impact Assessment): Real security impact vs operational robustness distinguished, primary controls vs defense-in-depth distinguished\n4. Phase 4 (PoC Creation): Pseudocode PoC created, executable/unit test PoCs created or explicitly skipped with justification, negative PoC created, PoC verification completed\n5. Phase 5 (Devil's Advocate): All 13 challenge questions addressed\n6. Gate Review: All 6 gates (Process, Reachability, Real Impact, PoC Validation, Math Bounds, Environment) evaluated with pass/fail\n7. Verdict: Each bug has a TRUE POSITIVE or FALSE POSITIVE verdict with evidence\n\nIf ANY bug is missing ANY of these phases or the gate review, respond with JSON: {\"ok\": false, \"reason\": \"<specific gaps>\"}\nIf all bugs have complete verification with verdicts, respond with JSON: {\"ok\": true}\nIf the conversation is not about fp-check verification at all, respond with JSON: {\"ok\": true}",
"timeout": 30
}
]
@@ -19,7 +19,7 @@
"hooks": [
{
"type": "prompt",
"prompt": "You are an output completeness checker for fp-check verification agents. A subagent is about to stop. Check whether it produced complete structured output for its assigned phases.\n\nIdentify which agent type this is from the conversation context and verify completeness:\n\n**data-flow-analyzer** must include:\n- Phase 1.1: Trust boundary map with source, path, sink, and validation points (each with file:line references)\n- Phase 1.2: API contract analysis (built-in protections identified or absence noted)\n- Phase 1.3: Environment protection analysis (each classified as 'prevents entirely' or 'raises bar')\n- Phase 1.4: Cross-reference analysis (similar patterns, test coverage, history)\n- Phase 1 Conclusion with evidence\n\n**exploitability-verifier** must include:\n- Phase 2.1: Attacker control analysis with control level (full/partial/none) and evidence\n- Phase 2.2: Mathematical bounds proof with step-by-step algebra, OR explicit 'N/A — not a bounds issue'\n- Phase 2.3: Race condition feasibility analysis, OR explicit 'N/A — not a concurrency issue'\n- Phase 2.4: Adversarial analysis synthesizing 2.1-2.3\n- Phase 2 Conclusion with evidence\n\n**poc-builder** must include:\n- Phase 4.1: Pseudocode PoC with data flow diagram (always required)\n- Phase 4.2: Executable PoC or explicit skip with justification\n- Phase 4.3: Unit test PoC or explicit skip with justification\n- Phase 4.4: Negative PoC showing exploit preconditions\n- Phase 4.5: Verification that PoCs demonstrate the vulnerability\n- Phase 4 Conclusion\n\nIf the agent is not an fp-check agent, return 'approve'.\nIf required sections are missing, return 'block' with the specific gaps.\nIf all required sections are present with evidence, return 'approve'.",
"prompt": "You are an output completeness checker for fp-check verification agents. A subagent is about to stop. Check whether it produced complete structured output for its assigned phases.\n\nIdentify which agent type this is from the conversation context and verify completeness:\n\n**data-flow-analyzer** must include:\n- Phase 1.1: Trust boundary map with source, path, sink, and validation points (each with file:line references)\n- Phase 1.2: API contract analysis (built-in protections identified or absence noted)\n- Phase 1.3: Environment protection analysis (each classified as 'prevents entirely' or 'raises bar')\n- Phase 1.4: Cross-reference analysis (similar patterns, test coverage, history)\n- Phase 1 Conclusion with evidence\n\n**exploitability-verifier** must include:\n- Phase 2.1: Attacker control analysis with control level (full/partial/none) and evidence\n- Phase 2.2: Mathematical bounds proof with step-by-step algebra, OR explicit 'N/A — not a bounds issue'\n- Phase 2.3: Race condition feasibility analysis, OR explicit 'N/A — not a concurrency issue'\n- Phase 2.4: Adversarial analysis synthesizing 2.1-2.3\n- Phase 2 Conclusion with evidence\n\n**poc-builder** must include:\n- Phase 4.1: Pseudocode PoC with data flow diagram (always required)\n- Phase 4.2: Executable PoC or explicit skip with justification\n- Phase 4.3: Unit test PoC or explicit skip with justification\n- Phase 4.4: Negative PoC showing exploit preconditions\n- Phase 4.5: Verification that PoCs demonstrate the vulnerability\n- Phase 4 Conclusion\n\nIf the agent is not an fp-check agent, respond with JSON: {\"ok\": true}\nIf required sections are missing, respond with JSON: {\"ok\": false, \"reason\": \"<specific gaps>\"}\nIf all required sections are present with evidence, respond with JSON: {\"ok\": true}",
"timeout": 30
}
]
plugins/second-opinion/.claude-plugin/plugin.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "second-opinion",
"version": "1.6.1",
"version": "1.7.0",
"description": "Runs code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits. Bundles Codex's built-in MCP server for direct tool access.",
"author": {
"name": "Dan Guido"
plugins/second-opinion/skills/second-opinion/SKILL.md
+4 -4
View File
@@ -172,14 +172,14 @@ structured output schema.
Summary:
- Uses `codex exec` (not `codex review`) for headless operation
- Model: `gpt-5.3-codex`, reasoning: `xhigh`
- Model: `gpt-5.5`, reasoning: `xhigh`
- Uses OpenAI's published code review prompt (fine-tuned into the model)
- Diff is generated manually and piped via stdin with the prompt
- `--output-schema` produces structured JSON findings
- `-o` captures only the final message (no thinking/exec noise)
- All three scopes (uncommitted, branch, commit) support project
context and focus instructions (no limitations)
- Falls back to `gpt-5.2-codex` on auth errors
- Falls back to `gpt-5.4` on auth errors
- Output is clean JSON — parse and present findings by priority
- Set `timeout: 600000` on the Bash call
@@ -219,7 +219,7 @@ When the user picks "Both" (the default):
2. Collect both results, then present with clear headers:
```
## Codex Review (gpt-5.3-codex)
## Codex Review (gpt-5.5)
<codex output>
## Gemini Review (gemini-3.1-pro-preview)
@@ -236,7 +236,7 @@ Summarize where the two reviews agree and differ.
| `gemini: command not found` | Tell user: `npm i -g @google/gemini-cli` |
| Gemini `code-review` extension missing | Tell user: `gemini extensions install https://github.com/gemini-cli-extensions/code-review` |
| Gemini `gemini-cli-security` extension missing | Tell user: `gemini extensions install https://github.com/gemini-cli-extensions/security` |
| Model auth error (Codex) | Retry with `gpt-5.2-codex` |
| Model auth error (Codex) | Retry with `gpt-5.4` |
| Empty diff | Tell user there are no changes to review |
| Timeout | Inform user and suggest narrowing the diff scope |
| Tool partially unavailable | Run only the available tool, note the skip |
plugins/second-opinion/skills/second-opinion/references/codex-invocation.md
+6 -6
View File
@@ -2,7 +2,7 @@
## Default Configuration
- Model: `gpt-5.3-codex`
- Model: `gpt-5.5`
- Reasoning effort: `xhigh`
## Approach
@@ -17,7 +17,7 @@ stdout.
Use this prompt verbatim — it is from OpenAI's [Build Code Review
with the Codex SDK](https://developers.openai.com/cookbook/examples/codex/build_code_review_with_codex_sdk)
cookbook, and GPT-5.2-codex and later received specific training
cookbook, and GPT-5.4 and later received specific training
on it:
```
@@ -86,7 +86,7 @@ been staged would be silently excluded. Generate the full diff:
```bash
codex exec \
-c model='"gpt-5.3-codex"' \
-c model='"gpt-5.5"' \
-c model_reasoning_effort='"xhigh"' \
--sandbox read-only \
--ephemeral \
@@ -141,16 +141,16 @@ diagnose the failure.
## Model Fallback
If `gpt-5.3-codex` fails with an auth error (e.g., "not supported
If `gpt-5.5` fails with an auth error (e.g., "not supported
when using Codex with a ChatGPT account"), retry with
`gpt-5.2-codex`. Log the fallback for the user.
`gpt-5.4`. Log the fallback for the user.
## Error Handling
| Error | Action |
|-------|--------|
| `codex: command not found` | Tell user: `npm i -g @openai/codex` |
| Model auth error | Retry with `gpt-5.2-codex` |
| Model auth error | Retry with `gpt-5.4` |
| Timeout | Suggest narrowing the diff scope |
| `EPERM` / sandbox errors | Expected — `codex exec` runs sandboxed. Ignore these. |
| Empty/missing output file | Read `$stderr_log` to diagnose the failure |
plugins/semgrep-rule-creator/.claude-plugin/plugin.json
+1 -1
View File
@@ -1,6 +1,6 @@
{
"name": "semgrep-rule-creator",
"version": "1.2.1",
"version": "1.2.2",
"description": "Create custom Semgrep rules for detecting bug patterns and security vulnerabilities",
"author": {
"name": "Maciej Domanski"
plugins/semgrep-rule-creator/skills/semgrep-rule-creator/SKILL.md
+5 -5
View File
@@ -156,10 +156,10 @@ Semgrep Rule Progress:
**REQUIRED**: Before writing any rule, use WebFetch to read **all** of these 7 links with Semgrep documentation:
1. [Rule Syntax](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/rule-syntax.md)
1. [Rule Syntax](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/rule-syntax.mdx)
2. [Pattern Syntax](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/pattern-syntax.mdx)
3. [Testing Rules](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/testing-rules.md)
4. [Taint analysis](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/data-flow/taint-mode/overview.md)
5. [Advanced techniques for taint analysis](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/data-flow/taint-mode/advanced.md)
6. [Constant propagation](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/data-flow/constant-propagation.md)
3. [Testing Rules](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/testing-rules.mdx)
4. [Taint analysis](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/data-flow/taint-mode/overview.mdx)
5. [Advanced techniques for taint analysis](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/data-flow/taint-mode/advanced.mdx)
6. [Constant propagation](https://raw.githubusercontent.com/semgrep/semgrep-docs/refs/heads/main/docs/writing-rules/data-flow/constant-propagation.mdx)
7. [Trail of Bits Testing Handbook - Semgrep chapter](https://raw.githubusercontent.com/trailofbits/testing-handbook/refs/heads/main/content/docs/static-analysis/semgrep/10-advanced.md)