How does this skill handle security tokens?

It includes strict validation and redaction rules, using masking logic to ensure SEMGREP_APP_TOKENs are never echoed in logs or leaked via verbose curl commands.

Which programming languages are supported for syntax checks?

The skill includes predefined syntax check commands for Python, JavaScript, TypeScript, Go, and Java to ensure fixes don't break the build.

What is the primary purpose of the Semgrep Conventions skill?

It provides standardized rules and patterns for Claude to interact with Semgrep, ensuring secure API calls, consistent error handling, and reliable automated code fixes.

Can it automatically fix security vulnerabilities?

Yes, it follows a structured decision tree that prioritizes Semgrep's native autofix, falls back to LLM-generated fixes when necessary, and verifies results with a re-scan.

Semgrep API & Fix Conventions

Name: Semgrep API & Fix Conventions
Author: KingInYellows

byKingInYellows

0•

安全与测试

Standardizes Semgrep integrations with specific rules for API communication, security validation, and automated vulnerability remediation.

This skill provides a comprehensive framework for interacting with the Semgrep API and local CLI within Claude Code environments. It enforces strict security protocols such as token redaction and three-layer error checking while streamlining the vulnerability lifecycle—from initial scan result interpretation to automated fix strategies. By providing predefined validation patterns and syntax-check tables for multiple languages, it ensures that security findings are triaged and resolved reliably without introducing regressions or exposing sensitive credentials.

主要功能

010 GitHub stars

02Multi-language syntax validation for Python, JavaScript, TypeScript, Go, and Java

03Strict JSON construction protocols using jq to eliminate interpolation risks

04Automated token validation and redaction to prevent sensitive credential leakage

05Standardized API request patterns with three-layer error handling and rate-limit retries

06Fix strategy decision tree for intelligent switching between native autofixes and LLM corrections

使用场景

01Ensuring secure and reliable communication between Claude agents and the Semgrep Web API

02Automating the triage and resolution of security findings detected by Semgrep

03Validating security patches for syntax correctness before applying them to a codebase

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add kinginyellows/yellow-plugins semgrep-conventions

For use in Claude.ai and ChatGPT

主要功能

010 GitHub stars

02Multi-language syntax validation for Python, JavaScript, TypeScript, Go, and Java

03Strict JSON construction protocols using jq to eliminate interpolation risks

04Automated token validation and redaction to prevent sensitive credential leakage

05Standardized API request patterns with three-layer error handling and rate-limit retries

06Fix strategy decision tree for intelligent switching between native autofixes and LLM corrections

使用场景

01Ensuring secure and reliable communication between Claude agents and the Semgrep Web API

02Automating the triage and resolution of security findings detected by Semgrep

03Validating security patches for syntax correctness before applying them to a codebase