skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

jxscout-custom-analyzers

Create custom static analysis analyzers for jxscout to detect project-specific code patterns.

11|1|Updated May 4, 2026
Search Tags:#static analysis#code patterns#security scanning#VS Code#semgrep#jxscout#custom analyzers
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill jxscout-custom-analyzers
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: jxscout-custom-analyzers
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/jxscout-custom-analyzers
Command: npx skills add https://github.com/dreadnode/capabilities --skill jxscout-custom-analyzers

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

jxscout's default static analysis only covers common, generic code patterns, leaving project-specific security risks, custom internal APIs, and unique code constructs un flagged. This Skill lets you create tailored analyzers to catch exactly the patterns your team cares about, no matter how niche.

Core Features & Use Cases

  • Flexible Analyzer Types: Choose from regex for simple literal patterns, derived analyzers to filter existing match kinds, or script analyzers for complex AST-based analysis (including semgrep integration for JS/TS code semantics).
  • VS Code Integration: Automatically add new custom match kinds to the jxscout VS Code extension sidebar for easy visibility and navigation of scan results.
  • Validated End-to-End Workflow: Includes guided steps for testing analyzers on individual files before full deployment, preserving existing built-in match kinds in the VS Code view, and retriggering project-wide analysis to generate new matches.
  • Use Case: A security engineer can build a custom semgrep-based analyzer to flag all postMessage handlers missing origin validation across a large JavaScript application, then view all flagged instances directly in their VS Code sidebar.

Quick Start

Use the jxscout-custom-analyzers skill to create a regex analyzer that flags all hardcoded internal API URLs in your project's JavaScript files, add it to your jxscout project settings, test it on a sample file to confirm it works, and retrigger full project analysis to see the new matches in your VS Code sidebar.

Frequently Asked Questions about jxscout-custom-analyzers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create custom static analysis rules for project-specific code patterns?▼

You can create custom static analysis rules by building analyzers using regex for simple literal patterns, derived analyzers to filter existing matches, or script-based semgrep integration for complex AST-based code semantics in JavaScript and TypeScript.

How do I add custom code pattern detection to the jxscout VS Code extension?▼

To add custom code pattern detection to the jxscout VS Code extension, you integrate your custom analyzers into the jxscout configuration system, which automatically populates the VS Code sidebar with new custom match kinds for easy visibility and navigation.

Can I use semgrep to write custom analyzers for JavaScript security scanning?▼

Yes, you can use semgrep to write custom script analyzers for JavaScript security scanning. This enables complex AST-based analysis to detect project-specific risks like postMessage handlers missing origin validation across your application.

What is the best way to test a custom code analyzer before running a full project scan?▼

The best way to test a custom code analyzer before a full project scan is to run it against individual sample files. This validated end-to-end workflow confirms the analyzer works correctly before retriggering full project analysis to generate new matches.

Does jxscout support analyzing reversed source code and HTML files for custom security patterns?▼

Yes, jxscout supports tailored code pattern detection for reversed source code and HTML files, allowing security engineers to flag unique constructs like hardcoded internal API endpoints and custom sensitive function calls.

Will adding new custom analyzers overwrite the default built-in matches in my VS Code sidebar?▼

No, adding new custom analyzers preserves existing built-in match kinds in the VS Code view. The validated workflow ensures your custom match results are added alongside default matches without overwriting them.

Related Skills

Explore More Software Engineering Skills→
dreadnodedreadnode
11

jxscout-bookmarks

Create and manage jxscout bookmark groups for security-relevant code.

Official
Intermediate
aram-devdocsaram-devdocs
6

review-changes

Dispatch five parallel agents to analyze pending code changes for security, performance, and architecture issues.

Community
Advanced
skeeper75skeeper75

moai-tool-ast-grep

Search, scan, and refactor code using AST patterns via ast-grep CLI.

Community
Advanced
igbuendigbuend
8

semgrep

Automates static code analysis with Semgrep to detect vulnerabilities and anti-patterns.

Community
Intermediate