Security Custom Rules Skill

Custom security rules let you enforce organization-specific coding standards and catch vulnerabilities unique to your codebase. Bootstrap rule directories in .specify/security/rules/ and .specify/security/bandit/, then draft patterns with metadata and test them against representative code before integrating into your security workflow.

Test custom rules by validating patterns against representative code samples that should and shouldn't match. Structure rules with correct metadata and documentation, then integrate test cases to ensure reproducible, auditable scans that reduce false positives in your security workflow.

Yes. Custom rules integrate directly into Semgrep and Bandit workflows. After drafting and testing your organization-specific rules in .specify/security/rules/, you can enforce them alongside standard checks to maintain consistent security standards across your codebase.

Custom rules target project-specific vulnerabilities and internal coding standards that built-in checks don't cover. They reduce false positives, improve scanning effectiveness, and make security enforcement reproducible and auditable across your organization.

Custom rules require proper structure, metadata describing the vulnerability or standard they enforce, test cases validating the pattern, and documentation explaining the rule's purpose. This ensures correct rule behavior, auditability, and reproducible scans across your security workflow.

While familiarity with Semgrep or Bandit syntax helps, this Skill guides you through rule creation from pattern drafting through testing and integration. You'll learn correct rule structure and metadata requirements as you build organization-specific rules for your codebase.