santosomar/vulnerability-pattern-matcher
skills/security/vulnerability-pattern-matcher/SKILL.md
Matches code against Project CodeGuard's catalog of known-dangerous patterns — banned C functions, weak crypto primitives, hardcoded credentials, deprecated APIs. Use when grepping for low-hanging security fruit, when enforcing a ban-list in CI, or when the user asks to check for known-bad patterns.
development
Updated Apr 13, 2026
$ install --global
skillsauthnpx skillsauth add santosomar/general-secure-coding-agent-skills vulnerability-pattern-matcherInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 13, 2026, 4:35 AM136.4s1 file scanned
SKILL.md
- name:
- vulnerability-pattern-matcher
- description:
- Matches code against Project CodeGuard's catalog of known-dangerous patterns — banned C functions, weak crypto primitives, hardcoded credentials, deprecated APIs. Use when grepping for low-hanging security fruit, when enforcing a ban-list in CI, or when the user asks to check for known-bad patterns.
- license:
- Apache-2.0
- category:
- security
- suite:
- general-secure-coding-agent-skills
- version:
- 0.3.0
- upstream:
- cosai-oasis/project-codeguard
- codeguard-version:
- 1.3.0
- related:
- static-vulnerability-detector
Vulnerability Pattern Matcher
This skill delegates to Project CodeGuard for its pattern catalog. Where static-vulnerability-detector traces data flow, this skill does lexical/syntactic matching against CodeGuard's ban-lists — faster, higher recall, more false positives.
Upstream: https://github.com/cosai-oasis/project-codeguard/tree/main/skills/software-security
Dispatch
| Pattern class | CodeGuard rule |
| -------------------------------------- | ------------------------------------------- |
| Banned C/C++ functions (strcpy, gets, sprintf, …) | codeguard-0-safe-c-functions |
| Weak crypto (MD5, SHA-1, DES, ECB, static IV) | codeguard-1-crypto-algorithms, codeguard-0-additional-cryptography |
| Hardcoded secrets (key prefixes, entropy, connection strings) | codeguard-1-hardcoded-credentials |
| Certificate handling (PEM blocks, weak sigs) | codeguard-1-digital-certificates |
| Deprecated OpenSSL/SSL APIs | codeguard-1-crypto-algorithms §"Deprecated SSL/Crypto APIs" |
Workflow
- grep/AST-match for the pattern classes above.
- For each hit, emit: file:line, matched pattern, the CodeGuard rule it violates, and that rule's prescribed replacement.
- Do not suppress matches based on context — that's
static-vulnerability-detector's job. This skill reports every hit; a human or a downstream flow triages.
Related Skills
santosomar/verified-pseudocode-extractor
development
VerifiedTrustedCommunity
Extracts human-readable pseudocode from a verified formal artifact (Dafny, Lean, TLA+) while preserving the verified properties as annotations, so the proof-carrying logic can be reimplemented in a production language. Use when porting verified code to an unverified target, when documenting what a formal spec actually does, or when handing a verified algorithm to an implementer.
SKILL.mdUpdated Apr 13, 2026
santosomar/tlaplus-spec-generator
development
VerifiedTrustedCommunity
Translates natural-language or pseudocode descriptions of concurrent and distributed systems into TLA+ specifications ready for the TLC model checker. Identifies state variables, actions, type invariants, safety properties, and liveness properties from the description. Use when formalizing a protocol, when the user describes a distributed algorithm to verify, when designing a consensus or locking scheme, or when starting formal verification of a concurrent system.
SKILL.mdUpdated Apr 13, 2026
santosomar/tlaplus-model-reduction
testing
VerifiedTrustedCommunity
Reduces a TLA+ model so TLC can actually check it — shrinks constants, adds state constraints, abstracts data, or applies symmetry — when the state space is too large to enumerate. Use when TLC runs out of memory, when checking takes hours, or when a spec works at N=2 and you need confidence at larger scale.
SKILL.mdUpdated Apr 13, 2026
santosomar/tlaplus-guided-code-repair
development
VerifiedTrustedCommunity
TLA+-specific instance of model-guided repair — reads a TLC error trace, identifies the enabling condition that should have been false, strengthens the corresponding action, and maps the fix to source code. Use when TLC reports an invariant violation or deadlock and you have the code-to-TLA+ mapping from extraction.
SKILL.mdUpdated Apr 13, 2026