jxscout-custom-analyzers

What problem does it solve?

jxscout's default static analysis only covers common, generic code patterns, leaving project-specific security risks, custom internal APIs, and unique code constructs un flagged. This Skill lets you create tailored analyzers to catch exactly the patterns your team cares about, no matter how niche.

Core Features & Use Cases

• Flexible Analyzer Types: Choose from regex for simple literal patterns, derived analyzers to filter existing match kinds, or script analyzers for complex AST-based analysis (including semgrep integration for JS/TS code semantics).
• VS Code Integration: Automatically add new custom match kinds to the jxscout VS Code extension sidebar for easy visibility and navigation of scan results.
• Validated End-to-End Workflow: Includes guided steps for testing analyzers on individual files before full deployment, preserving existing built-in match kinds in the VS Code view, and retriggering project-wide analysis to generate new matches.
• Use Case: A security engineer can build a custom semgrep-based analyzer to flag all postMessage handlers missing origin validation across a large JavaScript application, then view all flagged instances directly in their VS Code sidebar.

Quick Start

Use the jxscout-custom-analyzers skill to create a regex analyzer that flags all hardcoded internal API URLs in your project's JavaScript files, add it to your jxscout project settings, test it on a sample file to confirm it works, and retrigger full project analysis to see the new matches in your VS Code sidebar.