Secure Error Handling (harperaa) vs Semgrep Rule Creator (trailofbits)
Secure Error Handling (harperaa) and Semgrep Rule Creator (trailofbits) are both Security skills, so an agent choosing between them is matching on descriptions that overlap. Here is where they actually diverge.
Secure Error Handling
harperaa
A secure-coding pattern for the error path: return generic, environment-aware messages to users while logging the detail server-side, so a stack trace, database error, or file path never hands an attacker a map of your system. It shapes how failures are surfaced — not a scanner that finds the leaks for you, and narrower than a full security review: it does not cover auth, input validation, or the other vulnerability classes, only how errors are reported.
1 scenario in the bank answer to it
Semgrep Rule Creator
trailofbits
Authors a custom Semgrep static-analysis rule for one specific bug or vulnerability pattern — building the match (or a taint-mode source-to-sink data flow), then the paired vulnerable-and-safe test cases that keep false positives in check. Its output is a reusable detection rule, not a finished audit: it does not run existing Semgrep rulesets over your repo, triage the findings a scan produces, or review a diff by hand.
1 scenario in the bank answer to it
What is the difference between Secure Error Handling (harperaa) and Semgrep Rule Creator (trailofbits)?
- Secure Error Handling (harperaa)
- A secure-coding pattern for the error path: return generic, environment-aware messages to users while logging the detail server-side, so a stack trace, database error, or file path never hands an attacker a map of your system. It shapes how failures are surfaced — not a scanner that finds the leaks for you, and narrower than a full security review: it does not cover auth, input validation, or the other vulnerability classes, only how errors are reported.
- Semgrep Rule Creator (trailofbits)
- Authors a custom Semgrep static-analysis rule for one specific bug or vulnerability pattern — building the match (or a taint-mode source-to-sink data flow), then the paired vulnerable-and-safe test cases that keep false positives in check. Its output is a reusable detection rule, not a finished audit: it does not run existing Semgrep rulesets over your repo, triage the findings a scan produces, or review a diff by hand.
Should I use Secure Error Handling or Semgrep Rule Creator?
The clearest answer is a situation each one is unambiguously right for. Both of these are drawn from the game's question bank.
Reach for Secure Error Handling when
After last Tuesday's PostgreSQL meltdown, the company's public 500 page leaked the live connection string and internal locations to every visitor, so the CTO demanded a coding convention that shows zero implementation detail to browsers while keeping all diagnostics in a backend log.
The skill shapes the visible side of failures by framing a coding convention: it tells you to give browsers a bland, context-aware notice and to sequester every technical artifact—live connection strings, internal locations, diagnostic output—inside server logs, which exactly resolves the split the CTO asked for. semgrep-rule-creator-trailofbits is the genuinely tempting distractor because the leak feels like a source-level artifact you could catch with a static-analysis rule, but that skill merely writes reusable Semgrep detection rules for specific bug patterns and paired test cases; it never influences what a web framework displays on an HTTP response or where operational logs are directed, so it cannot close the gap between user-facing text and backend retention.
Reach for Semgrep Rule Creator when
At a security audit you discover your app mishandles a proprietary protocol in a way command-line scanners default ignore. You need to codify a narrowly scoped gatekeeper with paired illustrations to avoid noisy CI runs.
The skill is designed for narrowing the focus to exactly one novel weakness in code, teaching how to build a pair of contrasting code snippets and package them into a portable, reusable gatekeeper that plugs into CI. That fits here because the bug is proprietary and off-the-shelf checkers are blind to it, so you need a self-contained, narrowly scoped artifact with paired positive and negative illustrations rather than a supply-chain sweep, a generic error-message rewrite, or an identity breach lookup.
What they have in common
Both are filed under Security, the axis along which they collide. That shared ground is what makes an agent pick between them on description alone — and what makes it pick wrong.
Nearby comparisons
Reading the difference is not the same as spotting it at speed. That is the game.
Today's session