Comparison
Semgrep Rule Creator (trailofbits) vs What Leaked About You (useosint)
Semgrep Rule Creator (trailofbits) and What Leaked About You (useosint) are both Security skills, so an agent choosing between them is matching on descriptions that overlap. Here is where they actually diverge.
Semgrep Rule Creator
trailofbits
Authors a custom Semgrep static-analysis rule for one specific bug or vulnerability pattern - building the match (or a taint-mode source-to-sink data flow), then the paired vulnerable-and-safe test cases that keep false positives in check. Its output is a reusable detection rule, not a finished audit: it does not run existing Semgrep rulesets over your repo, triage the findings a scan produces, or review a diff by hand.
1 scenario in the bank answers to it
What Leaked About You
useosint
Checks an email, username, phone, or name against curated data-breach services - Have I Been Pwned, DeHashed, IntelX and the like - to enumerate which breaches an identity appears in and read what those records reveal, chiefly the list of services the person actually used. It is breach-exposure reconnaissance about a person, not a codebase tool: it does not scan your repository for hardcoded secrets, and it never uses a leaked password to access anything - reading the exposure is the whole job.
2 scenarios in the bank answer to it
What is the difference between Semgrep Rule Creator (trailofbits) and What Leaked About You (useosint)?
- Semgrep Rule Creator (trailofbits)
- Authors a custom Semgrep static-analysis rule for one specific bug or vulnerability pattern - building the match (or a taint-mode source-to-sink data flow), then the paired vulnerable-and-safe test cases that keep false positives in check. Its output is a reusable detection rule, not a finished audit: it does not run existing Semgrep rulesets over your repo, triage the findings a scan produces, or review a diff by hand.
- What Leaked About You (useosint)
- Checks an email, username, phone, or name against curated data-breach services - Have I Been Pwned, DeHashed, IntelX and the like - to enumerate which breaches an identity appears in and read what those records reveal, chiefly the list of services the person actually used. It is breach-exposure reconnaissance about a person, not a codebase tool: it does not scan your repository for hardcoded secrets, and it never uses a leaked password to access anything - reading the exposure is the whole job.
Should I use Semgrep Rule Creator or What Leaked About You?
The clearest answer is a situation each one is unambiguously right for. Both of these are drawn from the game's question bank.
Reach for Semgrep Rule Creator when
At a security audit you discover your app mishandles a proprietary protocol in a way command-line scanners default ignore. You need to codify a narrowly scoped gatekeeper with paired illustrations to avoid noisy CI runs.The skill is designed for narrowing the focus to exactly one novel weakness in code, teaching how to build a pair of contrasting code snippets and package them into a portable, reusable gatekeeper that plugs into CI. That fits here because the bug is proprietary and off-the-shelf checkers are blind to it, so you need a self-contained, narrowly scoped artifact with paired positive and negative illustrations rather than a supply-chain sweep, a generic error-message rewrite, or an identity breach lookup.
Reach for What Leaked About You when
You just found out that the online alias you used for your cat memes in 2014 is actually linked to your true handle. Now you want to know every sketchy site that might have spilled your details so you can tell your bank to watch for weird logins.This skill excels at cross-referencing an identity across known leak repositories to surface which external services were compromised and how deeply a person’s info was scattered, which is exactly what the situation calls for after a long-forgotten forum alias resurfaces; the distractors are all focused on code-level hygiene - one shapes friendly crash messages, another nudges libraries in package lock-files, and the third hunts custom vulnerability patterns in source code - none of which help map an individual’s breach footprint.
What they have in common
Both are filed under Security, the axis along which they collide. That shared ground is what makes an agent pick between them on description alone - and what makes it pick wrong.
Nearby comparisons
Reading the difference is not the same as spotting it at speed. That is the game.
Today's session