opengrep-rule-creator

Run the code recon stage first to produce CODE_RECON.md, then invoke this skill with your project directory. It proposes a prioritized rule queue from recon hot spots and known issues, writes each rule with tests, and validates them with the opengrep CLI.

Prefer taint mode whenever user input flows to a dangerous sink, and list every sanitizer and validator found during code recon in pattern-sanitizers or pattern-not. The skill enforces this as a non-negotiable quality checklist before validation.

Yes, use tailored mode with a rule description such as a CVE ID or library and method name. The skill fetches advisory details, finds usages in the recon report, and builds a rule matching only the vulnerable API with safe-pattern exclusions.

No, the CLI is optional. When opengrep with the validate subcommand is available it performs schema and syntax validation; otherwise the skill falls back to a structured static review covering pattern correctness, false-positive risk, and coverage.

No, it never executes target application code and does not run scans against the target codebase. Validation uses only opengrep validate on the rule and test fixture files, and all output is written to the opengrep-rules-creator directory.

KNOWN_ISSUES.md is a vulnerability register documenting past findings with root-cause patterns and safe alternatives. Entries become the highest-priority rule candidates, and specific root-cause descriptions produce more precise, lower-false-positive rules.