Hey folks! Awhile back I published a thread on using AI for productive, interactive, in-depth learning with the uConsole (“For Those That Are New, Here’s A Prompt that May Help”). Using that approach I spent some time getting exposure to some FOSS tools that I don’t usually have the luxury of working with on a daily basis. Specifically, I was focusing on Semgrep, Gitleaks, and (one of my favorites) Daniel Miessler’s Fabric for my first round. My “learning loop” strategy was:
- Get hands-on exposure to some tooling
- Build something functional and useful
- Rinse and repeat with more tools
I finally got around to sticking the first “something” into a Gitlab repo. The concept and the initial scripts were hand-coded by me, but then cleaned up using AI. I wanted to share it with you all in the event you might find this useful as well. The tool is simply called the Repo Scan Reporter.
The concept of the tool is fairly simple. Given a link to an OSS repo:
- Download the repo
- Scan the repo with Semgrep
- Scan the repo with Gitleaks
- Take the two resulting reports and analyze them using my model of choice with Fabric
- Take the finalized analysis and post it to Confluence
An example of where this might be useful is at a conference where FOSS tools are often announced and/or presented. Within a few minutes, a user could have scanned a tool for any obvious concerns and posted those results to a Confluence page where colleagues, who may not be at the conference, could have access to the analysis and perform review further. This creates a very quick documentation of tools found at the conference (because we all get “CON brain” while we’re there and forget stuff) and immediately gives exposure to those tools to the rest of the team.
It’s certainly not earth-shattering by any means, but it was fun and the whole process accomplished the intent that I set out to achieve. Hopefully you will enjoy this as well!