skills/semgrep/skills/code-security/Runlayer

code-security

Warn

Audited by Runlayer on Mar 9, 2026

Risk Level: MEDIUM

Scan Summary

Max Score

78%

Files

Flagged

Chunks

Flagged Files (4)

code-security/AGENTS.mdMEDIUM

77.6%

Tool passed security scan

Risky tool definition detected

code-security/rules/github-actions.mdLOW

71.0%

Risky tool definition detected

Checking out the incoming PR code while having access to secrets is dangerous because you may inadvertently execute arbitrary code from the incoming PR. **Incorrect (checking out PR code with pull_request_target):** ```yaml on: pull_request_target: jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 with: ref: ${{ github.event.pull_request.head.sha }} - run: npm install && npm build ``` **Correct (no checkout of PR code):** ```yaml on: pull_request_target: jobs:

code-security/rules/secrets.mdLOW

63.9%

Tool passed security scan

code-security/rules/ssrf.mdLOW

56.3%

Tool passed security scan

Passed Files (30)Click to expand

code-security/rules/csrf.mdOK

42.4%

Tool passed security scan

code-security/rules/insecure-transport.mdOK

39.8%

Tool passed security scan

code-security/rules/terraform-gcp.mdOK

39.0%

Tool passed security scan

code-security/rules/terraform-azure.mdOK

33.7%

Tool passed security scan

code-security/rules/race-condition.mdOK

33.1%

Tool passed security scan

code-security/rules/docker.mdOK

32.9%

Tool passed security scan

code-security/rules/kubernetes.mdOK

31.6%

Tool passed security scan

code-security/metadata.jsonOK

31.1%

Tool passed security scan

code-security/rules/regex-dos.mdOK

30.4%

Tool passed security scan

code-security/rules/terraform-aws.mdOK

29.9%

Tool passed security scan

code-security/rules/insecure-deserialization.mdOK

29.1%

Tool passed security scan

code-security/rules/authentication-jwt.mdOK

24.1%

Tool passed security scan

code-security/README.mdOK

20.7%

Tool passed security scan

code-security/rules/xxe.mdOK

20.0%

Tool passed security scan

code-security/SKILL.mdOK

19.1%

Tool passed security scan

code-security/rules/xss.mdOK

17.3%

Tool passed security scan

code-security/rules/insecure-crypto.mdOK

13.0%

Tool passed security scan

code-security/rules/unsafe-functions.mdOK

12.9%

Tool passed security scan

code-security/rules/command-injection.mdOK

12.8%

Tool passed security scan

code-security/rules/memory-safety.mdOK

11.6%

Tool passed security scan

code-security/rules/_sections.mdOK

11.5%

Tool passed security scan

code-security/rules/prototype-pollution.mdOK

10.5%

Tool passed security scan

code-security/rules/path-traversal.mdOK

10.1%

Tool passed security scan

code-security/rules/performance.mdOK

9.3%

Tool passed security scan

code-security/rules/code-injection.mdOK

9.1%

Tool passed security scan

code-security/rules/sql-injection.mdOK

4.3%

Tool passed security scan

code-security/rules/best-practice.mdOK

3.1%

Tool passed security scan

code-security/rules/maintainability.mdOK

1.1%

Tool passed security scan

code-security/rules/correctness.mdOK

1.0%

Tool passed security scan

code-security/rules/_template.mdOK

0.6%

Tool passed security scan

Audit Metadata

Max File Score

78%

Classification

KNOWN_SERVER_ALL_UNKNOWN

Files Scanned

Files Flagged

Chunks Analyzed

Analyzed

Mar 9, 2026, 08:43 AM