create-semgrep-rule

Name: create-semgrep-rule
Availability: InStock
Author: chrismcmacken

Create custom Semgrep rules with metadata and tests for vulnerability detection.

Updated Dec 25, 2025

Search Tags:#security #vulnerability #organization #static-analysis #rules #semgrep #pattern-abstraction

Ready to run

npx skills add https://github.com/chrismcmacken/bounty-hunter --skill create-semgrep-rule

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: create-semgrep-rule
Source: https://github.com/chrismcmacken/bounty-hunter/tree/main/.claude/skills/create-semgrep-rule
Command: npx skills add https://github.com/chrismcmacken/bounty-hunter --skill create-semgrep-rule

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Create custom Semgrep rules to detect vulnerabilities and anti-patterns in code, enabling precise, organization-specific security coverage.

Core Features & Use Cases

Rule authoring: Write Semgrep rules that target your specific languages and frameworks.
Org-specific rule libraries: Organize rules per organization with testing workflows.
Use Case: For example, a rule to detect unsafe eval usage in JavaScript and validate results locally or in CI.

Quick Start

Copy and adapt the provided rule templates, place them under custom-rules/custom/novel-vulns/, and run semgrep with your config against your repos to validate findings.

Frequently Asked Questions about create-semgrep-rule

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write custom Semgrep rules for organization-specific code vulnerabilities?▼

To write custom Semgrep rules for vulnerabilities, use structured templates that apply root-cause analysis and pattern abstraction to target organization-specific anti-patterns. Include complete metadata like CWE, severity, references, and tests to minimize false positives.

What is pattern abstraction in static analysis and when do I need it for security rules?▼

Pattern abstraction in static analysis generalizes specific code vulnerabilities into structural templates to detect variations across a codebase. You need it when writing Semgrep rules to ensure your organization-specific security coverage catches all instances of an anti-pattern, reducing false negatives.

How do I test Semgrep rules locally to minimize false positives?▼

Test Semgrep rules locally by placing custom rule templates under custom-rules/custom/novel-vulns/ and running semgrep with your config against target repositories. Validate findings using provided structured testing workflows and metadata to iteratively refine patterns and reduce false positives.

Can I use custom Semgrep rules to detect unsafe eval usage in JavaScript?▼

Yes, you can use custom Semgrep rules to detect unsafe eval usage in JavaScript and other framework-specific anti-patterns. The skill provides rule authoring templates that target specific languages and validate results locally or in CI environments.

What metadata should I include when creating static analysis rules for security vulnerabilities?▼

When creating static analysis rules for security vulnerabilities, include complete metadata such as CWE classifications, severity levels, references, and tests. This structured metadata ensures rules are properly categorized, validated, and produce actionable results for organization-specific security coverage.