{
  "name": "semgrep — 3 skills",
  "slug": "source-skills-d9dbdaf8415bd8a4f16ccec0",
  "type": "skills",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 3 skill declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared skill names (listing.json): add-and-validate-guardian-developer-semgrep-rule; install-mfw; remove-guardian-developer-semgrep-rule"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/semgrep/mcp-marketplace.git",
  "documentation_url": "https://github.com/semgrep/mcp-marketplace.git",
  "commit": "b58f407c6ac0f5fe47dee8301602f2e290a8ecfb",
  "tree_sha256": "546d15f2f4d9afda72463a9111d94d333b745ae57fba2798b3f011e3e5acb028",
  "file_sha256": {
    "plugin/.claude-plugin/plugin.json": "250a198077d2ed00b2bbefca406619423f6233648a02ab1dce0e8069f8357de8",
    "plugin/.codex-plugin/plugin.json": "393ee1f18b8c39a202222435c70048c8807e0be6456e5db6c593017bfe8a5a54",
    "plugin/.mcp.json": "0a295461ec7a8eeb2feea740a079f4ac23e8a4bb14c331421d70147798b0c2e1",
    "plugin/hooks/hooks.json": "85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2",
    "plugin/scripts/hook": "afb45a81c2524b828e844f4e739f88460ffdf1c7f7a1f32ad8da40d1ec3a5a48",
    "plugin/scripts/hook-darwin-amd64": "bed4eda75c4140024cbbc651b80472d24ddb681ff4268fd539827daa28e8dc8d",
    "plugin/scripts/hook-darwin-arm64": "b7f5cc37ac73140cd7cec8adb09841b9f737379278b0d9223b26c5600ce06440",
    "plugin/scripts/hook-linux-amd64": "d874f8da8f39edcbbd84472ec5b1695556598a442c9aac77b83ba63b0d318f10",
    "plugin/scripts/hook-linux-arm64": "5ce8b44adf35eb0a69142f56b414e22c19ca81ea4df65e7fde6df4cae2ade485",
    "plugin/scripts/hook.cmd": "8071d4776249fd78cb2c800cebb863054c6bcf7b5ea6e3b22aeea0ffde43f9fb",
    "plugin/scripts/hook.exe": "3d97802e58b7856767517d34ff32aad5b8c15be900173346cd9391abc712b0d6",
    "plugin/scripts/hook.sh": "3dff8e79d2c2d92211e3d011a82823706a65854f68e447bf2cc5601e01a0df83",
    "plugin/skills/add-and-validate-guardian-developer-semgrep-rule/SKILL.md": "cde31a31c56f1b7408350bf28daa69f8080e2416176df883577c5c768dfd78ef",
    "plugin/skills/install-mfw/SKILL.md": "e5479a19f4456e6280e87ec9dfe1846ae4660b46d146c78c81f605bc88448f60",
    "plugin/skills/install-mfw/scripts/inspect-shell-config.sh": "b687ad351fa160158d9d4f7240334fb891f936b8588b30fe2a080d8f22f57bc6",
    "plugin/skills/install-mfw/scripts/install-binary.sh": "4b668717db33351289ec90027f91e8836722061a6d570a355120dd5a55f2421b",
    "plugin/skills/remove-guardian-developer-semgrep-rule/SKILL.md": "7bb53bab73b48ff668c714f4ba0c6676c49565ed90e1286320c52ed999d8040b"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-19T18:07:17Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-19",
  "reviewed_date": "2026-10-19",
  "published_date": "2026-10-19",
  "modified_date": "2026-10-19",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit 11dde7217ae6f8e4ac4d18a6380b18ba01450122",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-19T18:07:17Z: pinned source inspection"
  ],
  "application": {
    "name": "semgrep — 3 skills",
    "softwareVersion": "b58f407c6ac0f5fe47dee8301602f2e290a8ecfb",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"plugin/skills/add-and-validate-guardian-developer-semgrep-rule/SKILL.md\",\n        \"name\": \"add-and-validate-guardian-developer-semgrep-rule\",\n        \"description\": \"write a custom semgrep rule with the user, add it to guardian in either user or repo scope, and prove it fires by writing a file that should trip it. use when someone wants guardian to catch something it currently misses, asks to write or add a semgrep rule, or wants a project convention enforced on the code claude writes.\",\n        \"files\": {\n          \"plugin/skills/add-and-validate-guardian-developer-semgrep-rule/SKILL.md\": \"cde31a31c56f1b7408350bf28daa69f8080e2416176df883577c5c768dfd78ef\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/install-mfw/SKILL.md\",\n        \"name\": \"install-mfw\",\n        \"description\": \"Install the mfw (Semgrep Malware Firewall) CLI via the curl|sh installer and walk the user through setup — trust store, PATH shims, shell integration, and the background daemon — asking questions at real decision points. Detects when the user's shell rc files are *managed* (symlinked into nix / home-manager / chezmoi / GNU stow / a dotfiles git repo) and, instead of clobbering them, adds mfw's source line to the right source-of-truth. Use when the user wants to install, set up, or onboard mfw on this machine.\",\n        \"files\": {\n          \"plugin/skills/install-mfw/SKILL.md\": \"e5479a19f4456e6280e87ec9dfe1846ae4660b46d146c78c81f605bc88448f60\",\n          \"plugin/skills/install-mfw/scripts/inspect-shell-config.sh\": \"b687ad351fa160158d9d4f7240334fb891f936b8588b30fe2a080d8f22f57bc6\",\n          \"plugin/skills/install-mfw/scripts/install-binary.sh\": \"4b668717db33351289ec90027f91e8836722061a6d570a355120dd5a55f2421b\"\n        }\n      },\n      {\n        \"path\": \"plugin/skills/remove-guardian-developer-semgrep-rule/SKILL.md\",\n        \"name\": \"remove-guardian-developer-semgrep-rule\",\n        \"description\": \"Remove a custom Semgrep rule from Guardian — list what is installed, work out which file holds the rule, and delete or edit it out of the user or repo rules directory. Use when someone wants Guardian to stop flagging something, asks to remove, delete or disable a custom rule, or wants to clear room under the rule limit.\",\n        \"files\": {\n          \"plugin/skills/remove-guardian-developer-semgrep-rule/SKILL.md\": \"7bb53bab73b48ff668c714f4ba0c6676c49565ed90e1286320c52ed999d8040b\"\n        }\n      }\n    ],\n    \"hooks\": [\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"PreToolUse\",\n        \"matcher\": \"Write|Edit|Bash|apply_patch\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto PreToolUse\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto PreToolUse\"\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"PostToolUse\",\n        \"matcher\": \"Write|Edit|Bash|apply_patch\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto PostToolUse --async\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto PostToolUse --async\",\n          \"async\": true\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"SessionStart\",\n        \"matcher\": \"startup|resume|clear|compact\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto SessionStatus\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto SessionStatus\",\n          \"timeout\": 5\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"SessionStart\",\n        \"matcher\": \"startup|resume|clear|compact\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto SessionStart --async\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto SessionStart --async\",\n          \"async\": true,\n          \"timeout\": 180\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"SessionStart\",\n        \"matcher\": \"startup|resume|clear|compact\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto Update --async\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto Update --async\",\n          \"async\": true,\n          \"timeout\": 180\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"Stop\",\n        \"matcher\": null,\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto Stop\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto Stop\",\n          \"timeout\": 35\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"Stop\",\n        \"matcher\": null,\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto StopRewake --async\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto StopRewake --async\",\n          \"async\": true,\n          \"asyncRewake\": true,\n          \"timeout\": 600\n        },\n        \"executed\": false\n      },\n      {\n        \"path\": \"plugin/hooks/hooks.json\",\n        \"sha256\": \"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2\",\n        \"event\": \"SessionEnd\",\n        \"matcher\": \"clear|resume|logout|prompt_input_exit|bypass_permissions_disabled|other\",\n        \"declaration\": {\n          \"type\": \"command\",\n          \"command\": \"\\\"${CLAUDE_PLUGIN_ROOT}/scripts/hook\\\" auto SessionEnd\",\n          \"commandWindows\": \"& \\\"$env:CLAUDE_PLUGIN_ROOT\\\\scripts\\\\hook.exe\\\" auto SessionEnd\",\n          \"timeout\": 3\n        },\n        \"executed\": false\n      }\n    ],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "7510807102d7b3bb4eb04f2a6be040d56db360c027555253e93ebfc6294965c0",
      "commands.json": "570b943d68b346ed9d135c4e7bfc0f6c920eeb34269ca47b61615288584d44d9",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "3dda1c745e33f49d322aaac20b66b93fc20a81cfcffdf5582e87b2dcff25a042",
      "listing.json": "3e70791be960b44234a59a281b89efc53524f734ebf5d501d25d19e810689dfa",
      "selection.json": "0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 3 skill declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared skill names (listing.json): add-and-validate-guardian-developer-semgrep-rule; install-mfw; remove-guardian-developer-semgrep-rule",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-19",
    "reviewed_sha256": "675a8ca9e07b14094440713177ee2a99f4745eb3617879eaf5bde4e740ea1d2f",
    "gates": "f1caa72519ccb71aad37b24a4b2c9ddba6f4282960f04fbcd38bae0796ce8902",
    "codex": "3832eb562400f50e28b9a53474aba92884e6591bb3554a8b75cf94883d298485",
    "grok": "5032a322a19f78faa8f59fe1b6052a9d4d08eda0cde998525a805a8811c79c2c",
    "summary": "Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."
  }
}