feat: add xgrep security skills to the marketplace

.claude-plugin/marketplace.json

@@ -5,7 +5,7 @@
     "name": "Mondoo"
   },
   "metadata": {
-    "description": "MQL (Mondoo Query Language) development and Mondoo MCP tools integration skills",
+    "description": "MQL (Mondoo Query Language) development and xgrep security skills for Claude Code and other agents",
     "version": "1.0.0"
   },
   "plugins": [
@@ -14,6 +14,42 @@
       "source": "./skills/mondoo-mql",
       "skills": "./",
       "description": "MQL query development with syntax guidance, platform-specific patterns, and MCP tool integration"
+    },
+    {
+      "name": "xgrep-inspect",
+      "source": "./skills/xgrep-inspect",
+      "skills": "./",
+      "description": "Navigate and understand source code using xgrep's AST-powered code intelligence"
+    },
+    {
+      "name": "xgrep-rule-creator",
+      "source": "./skills/xgrep-rule-creator",
+      "skills": "./",
+      "description": "Create custom xgrep rules for detecting security vulnerabilities and code patterns with test-first methodology"
+    },
+    {
+      "name": "xgrep-triage",
+      "source": "./skills/xgrep-triage",
+      "skills": "./",
+      "description": "Investigate and classify xgrep scan findings using code graph analysis"
+    },
+    {
+      "name": "xgrep-remediate",
+      "source": "./skills/xgrep-remediate",
+      "skills": "./",
+      "description": "Fix a confirmed xgrep finding safely using the verify/apply harness — apply deterministic fixes, author and verify assisted fixes against the fix contract, and surface advisory guidance"
+    },
+    {
+      "name": "xgrep-fix",
+      "source": "./skills/xgrep-fix",
+      "skills": "./",
+      "description": "Fix a whole set of xgrep findings — or just the triage-confirmed true positives in a findings.json — in one pass through the verify/apply harness"
+    },
+    {
+      "name": "secure-coding",
+      "source": "./skills/secure-coding",
+      "skills": "./",
+      "description": "Secure coding guidance for AI agents - proactively avoid generating vulnerable code patterns across 7 languages"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mondoo-skills",
-  "description": "MQL (Mondoo Query Language) development and Mondoo MCP tools integration skills",
+  "description": "MQL (Mondoo Query Language) development and xgrep security skills for Claude Code and other agents",
   "version": "1.0.0",
   "author": {
     "name": "Mondoo"

.cursor-plugin/marketplace.json

@@ -4,15 +4,15 @@
     "name": "Mondoo"
   },
   "metadata": {
-    "description": "MQL (Mondoo Query Language) development and Mondoo MCP tools integration skills",
+    "description": "MQL (Mondoo Query Language) development and xgrep security skills for Claude Code and other agents",
     "version": "1.0.0"
   },
   "plugins": [
     {
       "name": "mondoo-skills",
       "source": ".",
       "skills": "skills",
-      "description": "MQL (Mondoo Query Language) development and Mondoo MCP tools integration skills"
+      "description": "MQL (Mondoo Query Language) development and xgrep security skills for Claude Code and other agents"
     }
   ]
 }

.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mondoo-skills",
   "skills": "skills",
-  "description": "MQL (Mondoo Query Language) development and Mondoo MCP tools integration skills",
+  "description": "MQL (Mondoo Query Language) development and xgrep security skills for Claude Code and other agents",
   "version": "1.0.0",
   "author": {
     "name": "Mondoo"

README.md

@@ -1,6 +1,6 @@
 # Mondoo Skills
 
-A collection of agent skills for MQL (Mondoo Query Language) development and Mondoo MCP tools integration. Compatible with Claude Code, Codex, Gemini CLI, and Cursor.
+A collection of agent skills for MQL (Mondoo Query Language) development and for [xgrep](https://github.com/mondoohq/xgrep)-powered security work — code inspection, rule authoring, finding triage, and remediation. Compatible with Claude Code, Codex, Gemini CLI, and Cursor.
 
 The skills in this repository follow the standardized [Agent Skills](https://agentskills.io/home) format.
 
@@ -62,6 +62,8 @@ The skills automatically activate when working on relevant tasks. You can also i
 
 ```shell
 /mondoo-mql
+/xgrep-triage
+/xgrep-rule
 ```
 
 ## Available Skills
@@ -70,6 +72,12 @@ The skills automatically activate when working on relevant tasks. You can also i
 | Name | Description | Documentation |
 |------|-------------|---------------|
 | `mondoo-mql` | MQL query development with syntax guidance, platform-specific patterns, and MCP tool integration | [SKILL.md](skills/mondoo-mql/SKILL.md) |
+| `secure-coding` | Secure coding guidance for AI agents - proactively avoid generating vulnerable code patterns across 7 languages | [SKILL.md](skills/secure-coding/SKILL.md) |
+| `xgrep-fix` | Fix a whole set of xgrep findings — or just the triage-confirmed true positives in a findings.json — in one pass through the verify/apply harness | [SKILL.md](skills/xgrep-fix/SKILL.md) |
+| `xgrep-inspect` | Navigate and understand source code using xgrep's AST-powered code intelligence | [SKILL.md](skills/xgrep-inspect/SKILL.md) |
+| `xgrep-remediate` | Fix a confirmed xgrep finding safely using the verify/apply harness — apply deterministic fixes, author and verify assisted fixes against the fix contract, and surface advisory guidance | [SKILL.md](skills/xgrep-remediate/SKILL.md) |
+| `xgrep-rule-creator` | Create custom xgrep rules for detecting security vulnerabilities and code patterns with test-first methodology | [SKILL.md](skills/xgrep-rule-creator/SKILL.md) |
+| `xgrep-triage` | Investigate and classify xgrep scan findings using code graph analysis | [SKILL.md](skills/xgrep-triage/SKILL.md) |
 <!-- END_SKILLS_TABLE -->
 
 ## What's Included
@@ -96,6 +104,21 @@ The skill documents how to use Mondoo's MCP server tools:
 | `mql-bundle-lint` | Lint policy bundles |
 | `mql-bundle-format` | Format policy YAML |
 
+### xgrep Skills
+
+A set of skills built on [xgrep](https://github.com/mondoohq/xgrep), Mondoo's fast,
+Semgrep-compatible SAST scanner, for security review and remediation workflows:
+
+- **`xgrep-inspect`** - Navigate and understand source code using xgrep's AST-powered code intelligence
+- **`xgrep-rule-creator`** - Create custom xgrep rules with a test-first methodology, or port rules to new languages
+- **`xgrep-triage`** - Investigate and classify scan findings using code-graph analysis
+- **`xgrep-remediate`** - Fix a confirmed finding safely using xgrep's verify/apply harness
+- **`xgrep-fix`** - Fix a whole set of findings — or the true positives a triage report confirmed — in one pass
+- **`secure-coding`** - Proactively avoid generating vulnerable code across 7 languages
+
+These skills drive the `xgrep` CLI; install it from the
+[xgrep repository](https://github.com/mondoohq/xgrep) to use them.
+
 ## License
 
 Apache-2.0

agents/AGENTS.md

@@ -4,10 +4,22 @@ You have additional SKILLs documented in directories containing a "SKILL.md" fil
 
 These skills are:
  - mondoo-mql -> "skills/mondoo-mql/SKILL.md"
+ - secure-coding -> "skills/secure-coding/SKILL.md"
+ - xgrep-fix -> "skills/xgrep-fix/SKILL.md"
+ - xgrep-inspect -> "skills/xgrep-inspect/SKILL.md"
+ - xgrep-remediate -> "skills/xgrep-remediate/SKILL.md"
+ - xgrep-rule-creator -> "skills/xgrep-rule-creator/SKILL.md"
+ - xgrep-triage -> "skills/xgrep-triage/SKILL.md"
 
 IMPORTANT: You MUST read the SKILL.md file whenever the description of the skills matches the user intent, or may help accomplish their task.
 
 mondoo-mql: `Use when writing MQL (Mondoo Query Language) queries, working with Mondoo MCP tools, or developing security policies`
+secure-coding: `Review code for security vulnerabilities and provide secure coding guidance across Go, Python, JavaScript, Java, Ruby, C#, and Swift. Triggers on code review, security questions, and vulnerability prevention.`
+xgrep-fix: `Fixes a whole set of xgrep findings — or just the triage-confirmed true positives in a findings.json — in one pass via the verify/apply harness. Auto-applies deterministic fixes (xgrep fix --confirmed), drives the assisted author/verify/apply loop per finding, and surfaces advisory guidance, reporting a per-fingerprint summary. Use to remediate many findings at once after a scan or triage.`
+xgrep-inspect: `Investigates and navigates source code using xgrep's AST-powered code intelligence. Use when exploring unfamiliar code, finding definitions/references, understanding dependencies, or assessing change impact.`
+xgrep-remediate: `Fixes a confirmed xgrep finding safely using the verify/apply harness — applies deterministic fixes, authors and verifies assisted fixes against the fix contract, and surfaces advisory guidance. Use to remediate a specific finding you already believe is a true positive.`
+xgrep-rule-creator: `Creates custom xgrep rules for detecting security vulnerabilities, bug patterns, and code anti-patterns. Supports both creating new rules from scratch and porting existing rules to new languages. Use when writing xgrep/Semgrep YAML rules or building custom static analysis detections.`
+xgrep-triage: `Investigates and classifies xgrep scan findings using code graph analysis for call chain navigation and dataflow tracing. Use when triaging SAST findings, investigating vulnerabilities, or classifying true/false positives.`
 
 Paths referenced within SKILL.md files are relative to that skill's directory.
 

gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "mondoo-skills",
-  "description": "MQL (Mondoo Query Language) development and Mondoo MCP tools integration skills",
+  "description": "MQL (Mondoo Query Language) development and xgrep security skills for Claude Code and other agents",
   "version": "1.0.0",
   "contextFileName": "agents/AGENTS.md"
 }

skills/secure-coding/README.md

@@ -0,0 +1,30 @@
+# Secure Coding Skill
+
+A Claude Code skill that provides secure coding guidance to AI agents, helping
+them proactively avoid generating vulnerable code patterns.
+
+## What it does
+
+- Reviews code for common security anti-patterns across Go, Python, JavaScript/TypeScript, Java, Ruby, C#, and Swift
+- Provides language-specific safe alternatives for each vulnerable pattern
+- Covers 15 vulnerability categories derived from real CVEs
+- Can be triggered proactively during code generation or on-demand for review
+
+## Finding types covered
+
+Timing attacks, SQL injection, SSRF, path traversal, code injection, XSS,
+JWT issues, insecure TLS, certificate validation, deserialization, HTTP
+header injection, CORS, sensitive data logging, weak random, race conditions.
+
+## Usage
+
+```
+/secure-coding review this function for security issues
+/secure-coding what's the safe way to compare secrets in Go?
+/secure-coding check this PR for vulnerabilities
+```
+
+## Installation
+
+Copy the `skills/secure-coding/` directory into your project or install via
+the Claude Code skill registry.

skills/secure-coding/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: secure-coding
+description: Review code for security vulnerabilities and provide secure coding guidance across Go, Python, JavaScript, Java, Ruby, C#, and Swift. Triggers on code review, security questions, and vulnerability prevention.
+allowed-tools: Bash Read Edit Glob Grep
+---
+
+# Secure Coding
+
+Proactively avoid generating vulnerable code. When writing, reviewing, or
+modifying code, check against the pattern tables in this skill to use safe
+alternatives instead of dangerous patterns.
+
+## When to Use
+
+- Reviewing code for security issues
+- Writing new code that handles user input, secrets, HTTP requests, file I/O, or crypto
+- Answering "is this safe?" or "how do I securely..." questions
+- Generating code that touches authentication, authorization, or data validation
+
+## When NOT to Use
+
+- Writing xgrep detection rules (use `xgrep-rule-creator` skill)
+- Triaging existing SAST scan findings (use `xgrep-triage` skill)
+- Non-security code questions (algorithms, performance, etc.)
+
+## Detecting Intent
+
+**Code review**: User shares code or asks to review a file/PR for security issues.
+**Secure alternative**: User asks how to do something safely ("how do I compare secrets in Go?").
+**Proactive**: User is writing code that touches a security-sensitive area.
+
+## Quick Reference -- Most Critical Patterns
+
+### Never Do This
+
+| Pattern | Why | Safe Alternative |
+|---------|-----|-----------------|
+| `secret == expected` | Timing attack | Constant-time compare (see patterns.md) |
+| `"SELECT * FROM t WHERE id=" + input` | SQL injection | Parameterized queries |
+| `eval(user_input)` | Code execution | `json.loads()`, `ast.literal_eval()` |
+| `requests.get(user_url)` | SSRF | URL allowlist validation |
+| `open(user_filename)` | Path traversal | `os.path.basename()` + join |
+| `pickle.load(data)` / `yaml.load(data)` | Deserialization RCE | `json.loads()` / `yaml.safe_load()` |
+| `jwt.decode(token, secret)` (no algorithms) | JWT alg confusion | `jwt.decode(token, secret, algorithms=["HS256"])` |
+| `InsecureSkipVerify: true` | MitM attack | Remove or set `false` |
+| `Math.random()` for tokens | Predictable | `crypto.randomBytes()` |
+| `tls.Config{MinVersion: tls.VersionTLS10}` | Deprecated TLS | `MinVersion: tls.VersionTLS12` |
+
+## References
+
+- Full per-language pattern tables: [references/patterns.md]({baseDir}/references/patterns.md)
+- Real CVE code examples: [references/cve-examples.md]({baseDir}/references/cve-examples.md)
+
+## Review Checklist
+
+When reviewing code, check for these in order:
+
+```
+Security Review:
+- [ ] Secret comparison uses constant-time function
+- [ ] SQL queries use parameterized placeholders
+- [ ] No eval/exec/compile on untrusted input
+- [ ] HTTP requests validate URLs against allowlist
+- [ ] File paths validated against base directory
+- [ ] Deserialization uses safe loaders with type restrictions
+- [ ] JWT decoding specifies allowed algorithms
+- [ ] TLS >= 1.2, certificate validation enabled
+- [ ] Crypto RNG used for security values (not math/rand)
+- [ ] No secrets in log output
+- [ ] CORS restricted to specific origins
+- [ ] HTTP response headers don't include unsanitized user input
+- [ ] File creation uses atomic mode setting (no chmod race)
+- [ ] XSS: output encoded for context (HTML, JS, URL)
+```

skills/secure-coding/commands/secure-coding.md

@@ -0,0 +1,44 @@
+---
+name: secure-coding
+description: Review code for security vulnerabilities or get secure coding guidance for a specific language/pattern
+argument-hint: "(describe what to review, or ask about a specific pattern)"
+allowed-tools: Bash Read Edit Glob Grep
+---
+
+# Secure Coding Review
+
+**Arguments:** $ARGUMENTS
+
+Review code or answer security questions using the vulnerability pattern reference
+in [references/patterns.md]({baseDir}/references/patterns.md).
+
+## Behavior
+
+**When reviewing code or a file:**
+1. Read the file(s) to review
+2. Check each function/block against the 15 vulnerability categories in the patterns reference
+3. Report findings with: the vulnerable line, which pattern it matches, and the safe alternative
+4. If no issues found, say so explicitly
+
+**When answering "how do I safely..." questions:**
+1. Look up the relevant category in the patterns reference
+2. Give the language-specific safe pattern with a code example
+3. Cite the CVE that demonstrates why the unsafe pattern is dangerous
+
+**When generating or modifying code:**
+1. Before writing, check if the code involves any of the 15 categories
+2. Use the safe alternative from the start, not the dangerous pattern
+3. Add a brief comment explaining the security choice only if non-obvious
+
+## What to look for
+
+Prioritize by severity:
+1. **Critical**: SQL injection, code injection, deserialization, JWT bypass
+2. **High**: SSRF, path traversal, disabled cert validation, header injection
+3. **Medium**: Timing attacks, insecure TLS, CORS, weak random, sensitive logging
+4. **Low**: Race conditions (TOCTOU)
+
+## References
+
+- Full pattern tables: [references/patterns.md]({baseDir}/references/patterns.md)
+- Real CVE examples: [references/cve-examples.md]({baseDir}/references/cve-examples.md)