Comparison
Security Review (waybarrios) vs Semgrep Rule Creator (trailofbits)
Security Review (waybarrios) and Semgrep Rule Creator (trailofbits) are both Security skills, so an agent choosing between them is matching on descriptions that overlap. Here is where they actually diverge.
Security Review
waybarrios/opencode-power-pack
Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
3 scenarios in the bank answer to it
Semgrep Rule Creator
trailofbits
Authors a custom Semgrep static-analysis rule for one specific bug or vulnerability pattern - building the match (or a taint-mode source-to-sink data flow), then the paired vulnerable-and-safe test cases that keep false positives in check. Its output is a reusable detection rule, not a finished audit: it does not run existing Semgrep rulesets over your repo, triage the findings a scan produces, or review a diff by hand.
1 scenario in the bank answers to it
What is the difference between Security Review (waybarrios) and Semgrep Rule Creator (trailofbits)?
- Security Review (waybarrios)
- Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
- Semgrep Rule Creator (trailofbits)
- Authors a custom Semgrep static-analysis rule for one specific bug or vulnerability pattern - building the match (or a taint-mode source-to-sink data flow), then the paired vulnerable-and-safe test cases that keep false positives in check. Its output is a reusable detection rule, not a finished audit: it does not run existing Semgrep rulesets over your repo, triage the findings a scan produces, or review a diff by hand.
Should I use Security Review (waybarrios) or Semgrep Rule Creator?
The clearest answer is a situation each one is unambiguously right for. Both of these are drawn from the game's question bank.
Reach for Security Review (waybarrios) when
Before merging a feature branch, run a targeted inspection of those unmerged commits for issues an attacker could exploit, then follow with a comprehensive review covering correctness, architecture and tests.Start with the focused branch security check to catch high-confidence exploitable mistakes early; those findings may require code changes that affect design and tests. Doing the broad review first can surface many items, but if a security fix changes interfaces or architecture you'll end up redoing parts of the wide review - the focused pass narrows the highest-risk edits before the full sweep.
Reach for Semgrep Rule Creator when
At a security audit you discover your app mishandles a proprietary protocol in a way command-line scanners default ignore. You need to codify a narrowly scoped gatekeeper with paired illustrations to avoid noisy CI runs.The skill is designed for narrowing the focus to exactly one novel weakness in code, teaching how to build a pair of contrasting code snippets and package them into a portable, reusable gatekeeper that plugs into CI. That fits here because the bug is proprietary and off-the-shelf checkers are blind to it, so you need a self-contained, narrowly scoped artifact with paired positive and negative illustrations rather than a supply-chain sweep, a generic error-message rewrite, or an identity breach lookup.
What they have in common
Both are filed under Security, the axis along which they collide. That shared ground is what makes an agent pick between them on description alone - and what makes it pick wrong.
Nearby comparisons
- Security Review (affaan-m) vs Security Review (waybarrios)
- Security Review (Sentry) vs Security Review (waybarrios)
- Dependency Updater vs Security Review (waybarrios)
- Secure Error Handling vs Security Review (waybarrios)
- Security Review (waybarrios) vs Security Reviewer
- Security Review (affaan-m) vs Semgrep Rule Creator
Reading the difference is not the same as spotting it at speed. That is the game.
Today's session