feat: add xgrep security skills to the marketplace - #9
Merged
Conversation
Publish the six xgrep AI-agent skills — xgrep-inspect, xgrep-rule-creator, xgrep-triage, xgrep-remediate, xgrep-fix, and secure-coding — as marketplace plugins so they install the standard way (/plugin install <name>@mondoohq/skills) instead of the bespoke `xgrep skill install` subcommand. These previously lived inside and were compiled into the xgrep binary; the marketplace now becomes the single source of truth. Each skill is flattened to the repo convention (SKILL.md + references/ at the skill root, commands/ alongside) and registered in .claude-plugin/marketplace.json. Regenerated agents/AGENTS.md and the README skills table via scripts/publish.sh, and broadened the repo branding to cover MQL + xgrep skills. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![mondoo-code-review[bot]](https://avatars.githubusercontent.com/in/2834902?s=60&v=4){kind=small}
…ix note - xgrep-rule-creator/workflow.md: remove inline `// ruleid:` / `// ok:` annotations from the Go porting example and the taint anti-pattern so they match the "clean, annotation-free source files; expectations live in the Go test's ExpectMatch" convention stated earlier in the same doc. - xgrep-fix/SKILL.md: consolidate the two duplicate paragraphs explaining that `fix` only auto-applies the deterministic tier. The flagged 2026-dated CVEs (Rails CVE-2026-33195, pac4j CVE-2026-29000, Cloudreve CVE-2026-25726) and `secrets.compare_digest` were verified as real and left unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
Author
|
/review |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Publishes the six xgrep AI-agent skills as marketplace plugins so users install them the standard way instead of the bespoke
xgrep skill installsubcommand:xgrep-inspect— navigate/understand source with xgrep's AST code intelligencexgrep-rule-creator— author custom xgrep rules (test-first) / port to new languagesxgrep-triage— investigate & classify findings via code-graph analysisxgrep-remediate— fix a confirmed finding via the verify/apply harnessxgrep-fix— fix a whole set of findings (or triage-confirmed TPs) in one passsecure-coding— proactively avoid generating vulnerable code (7 languages)These previously lived inside the xgrep repo and were compiled into the binary. This repo now becomes the single source of truth; a companion xgrep PR removes the in-binary copies and the
xgrep skillcommand.What changed
skills/<name>/for each of the 6, flattened to the repo convention:SKILL.md+references/at the skill root,commands/alongside. Per-skill.claude-plugin/plugin.jsondropped in favor of the top-level marketplace entry..claude-plugin/marketplace.json— 6 new plugin entries + broadened metadata description.agents/AGENTS.mdand the README skills table viascripts/publish.sh(now 7 skills)../scripts/publish.sh --checkpasses.Install after merge
🤖 Generated with Claude Code