📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/semgrep-rule-creator/SKILL.md

@@ -49,7 +49,7 @@ When writing Semgrep rules, reject these common shortcuts:
 pattern: $FUNC(...)
 
 # GOOD: Specific dangerous function
-pattern: eval(...)
+pattern: eval(...) # security-allowlist: Semgrep sink pattern
 ```
 
 **Missing safe cases in tests** - leads to undetected false positives:
@@ -101,7 +101,7 @@ This skill guides creation of Semgrep rules that detect security vulnerabilities
 - **Taint mode** (prioritize): Data flow issues where untrusted input reaches dangerous sinks
 - **Pattern matching**: Simple syntactic patterns without data flow requirements
 
-**Why prioritize taint mode?** Pattern matching finds syntax but misses context. A pattern `eval($X)` matches both `eval(user_input)` (vulnerable) and `eval("safe_literal")` (safe). Taint mode tracks data flow, so it only alerts when untrusted data actually reaches the sink—dramatically reducing false positives for injection vulnerabilities.
+**Why prioritize taint mode?** Pattern matching finds syntax but misses context. A pattern `eval($X)` matches both `eval(user_input)` (vulnerable) and `eval("safe_literal")` (safe). Taint mode tracks data flow, so it only alerts when untrusted data actually reaches the sink—dramatically reducing false positives for injection vulnerabilities. <!-- security-allowlist: Semgrep taint-mode explanation -->
 
 **Iterating between approaches:** It's okay to experiment. If you start with taint mode and it's not working well (e.g., taint doesn't propagate as expected, too many false positives/negatives), switch to pattern matching. Conversely, if pattern matching produces too many false positives on safe cases, try taint mode instead. The goal is a working rule—not rigid adherence to one approach.
 
@@ -119,21 +119,21 @@ rules:
   - id: insecure-eval
     languages: [python]
     severity: HIGH
-    message: User input passed to eval() allows code execution
+    message: User input passed to eval() allows code execution # security-allowlist: Semgrep finding message
     mode: taint
     pattern-sources:
       - pattern: request.args.get(...)
     pattern-sinks:
-      - pattern: eval(...)
+      - pattern: eval(...) # security-allowlist: Semgrep sink pattern
 ```
 
 Test file (`insecure-eval.py`):
 ```python
 # ruleid: insecure-eval
-eval(request.args.get('code'))
+eval(request.args.get('code'))  # security-allowlist: intentionally vulnerable Semgrep fixture
 
 # ok: insecure-eval
-eval("print('safe')")
+eval("print('safe')")  # security-allowlist: safe-literal Semgrep fixture
 ```
 
 Run tests (from rule directory): `semgrep --test --config <rule-id>.yaml <rule-id>.<ext>`