skills.rest
invoke1442
invoke1442COMMUNITY
Explore all skills by this author →
GitHub

alibaba-dsl

Validate Alibaba DSL Skill Units with SKILL.md and verify.sh.

Updated Apr 3, 2026
Search Tags:#javascript#java#sast#roster#taint-analysis#rule-authoring#alibaba-dsl
One-click install
npx skills add https://github.com/invoke1442/Playground --skill alibaba-dsl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: alibaba-dsl
Source: https://github.com/invoke1442/Playground/tree/main/Skills/tech-learning/workspace/alibaba-dsl-learning/alibaba-dsl-skill/alibaba-dsl-skill
Command: npx skills add https://github.com/invoke1442/Playground --skill alibaba-dsl

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables precise authoring and verification of Alibaba DSL taint-analysis rules for Java and JavaScript SAST scanning, unifying rule creation with roster-driven definitions.

Core Features & Use Cases

  • Roster-centric workflow: define source/sink/sanitizer semantics in rosters, then compose rules via imports.
  • End-to-end verification: bundle rosters, rules, and relation config, then verify with the provided verify.sh script.
  • Real-world scenarios: author taint rules to detect common vulnerabilities (SSRF, XSS, SQLi) across Java/JS apps with consistent validation.

Quick Start

Create a new Alibaba DSL Skill unit by placing SKILL.md in a skill folder and wiring a roster + rule with relation config, then run the verify script.

Frequently Asked Questions about alibaba-dsl

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I author taint-analysis rules for Java and JavaScript SAST scanning?▼

The roster-centric pattern defines source, sink, and sanitizer semantics in rosters, then composes taint-analysis rules via imports to detect vulnerabilities like SSRF, XSS, and SQLi in Java and JavaScript applications.

What is the roster-centric pattern for SAST rule authoring?▼

The roster-centric pattern separates taint-analysis rule authoring into rosters that define source, sink, and sanitizer semantics, which are then composed into rules via imports for consistent SAST vulnerability detection.

How do I validate custom taint rules for Java and JavaScript?▼

You validate custom taint rules by bundling your rosters, rules, and relation configs together, then running the provided verify.sh script to ensure correct end-to-end execution.

Can I use Alibaba DSL rules to detect SSRF and XSS vulnerabilities?▼

Yes, you can author taint rules using the Alibaba DSL to detect common vulnerabilities including SSRF, XSS, and SQLi across Java and JavaScript applications with consistent validation.

What are the requirements for creating an Alibaba DSL Skill unit?▼

Creating an Alibaba DSL Skill unit requires placing a SKILL.md file at the root folder with mandatory name and description frontmatter, then wiring a roster, rule, and relation config.

Related Skills

Explore More Software Engineering Skills→
davebreamdavebream
4

biblical-segmentation

Extract and validate SKILL.md frontmatter metadata into a YAML document.

Community
Advanced
noviadinoviadi

writing-verify-script

Create a deterministic verify.sh script that runs tests, linting, formatting, and type checking.

Community
Basic
cybersecwomancybersecwoman
5

security-arsenal

Provide security payloads and bypass techniques for web application vulnerabilities.

Community
Advanced
0x53c70x53c7
1

sast-investigator

Trace source-to-sink data flow to classify SAST findings as true positives.

Official
Advanced