create-semgrep-rule

To write custom Semgrep rules for vulnerabilities, use structured templates that apply root-cause analysis and pattern abstraction to target organization-specific anti-patterns. Include complete metadata like CWE, severity, references, and tests to minimize false positives.

Pattern abstraction in static analysis generalizes specific code vulnerabilities into structural templates to detect variations across a codebase. You need it when writing Semgrep rules to ensure your organization-specific security coverage catches all instances of an anti-pattern, reducing false negatives.

Test Semgrep rules locally by placing custom rule templates under custom-rules/custom/novel-vulns/ and running semgrep with your config against target repositories. Validate findings using provided structured testing workflows and metadata to iteratively refine patterns and reduce false positives.

Yes, you can use custom Semgrep rules to detect unsafe eval usage in JavaScript and other framework-specific anti-patterns. The skill provides rule authoring templates that target specific languages and validate results locally or in CI environments.

When creating static analysis rules for security vulnerabilities, include complete metadata such as CWE classifications, severity levels, references, and tests. This structured metadata ensures rules are properly categorized, validated, and produce actionable results for organization-specific security coverage.