semgrep-rule-creator

Name: semgrep-rule-creator
Availability: InStock
Author: Superlend

Generate Semgrep rules with tests and validate via semgrep --test.

Updated Jul 10, 2025

Search Tags:#testing #security #static-analysis #semgrep #rule-writing #taint-mode

Ready to run

npx skills add https://github.com/Superlend/superloop-core-contracts --skill semgrep-rule-creator

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep-rule-creator
Source: https://github.com/Superlend/superloop-core-contracts/tree/main/.cursor/skills/semgrep-rule-creator/skills/semgrep-rule-creator
Command: npx skills add https://github.com/Superlend/superloop-core-contracts --skill semgrep-rule-creator

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps engineers create production-ready Semgrep rules to detect security vulnerabilities, buggy patterns, and code-quality issues.

Core Features & Use Cases

Guided rule writing with testing templates for Semgrep rules.
Supports taint-mode and pattern-based detection for precise results.
Test-driven development workflow with rule and test generation guidance.

Quick Start

Use the semgrep-rule-creator skill to generate a new Semgrep rule and its tests for a sample vulnerability pattern. Then run semgrep --test with the rule to validate.

Frequently Asked Questions about semgrep-rule-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write a Semgrep rule for detecting security vulnerabilities?▼

Writing a Semgrep rule involves defining pattern or taint-mode syntax to match specific code constructs, then validating the detection logic by running semgrep --test with explicit test cases to ensure accuracy.

What is taint-mode analysis in static analysis rules?▼

Taint-mode analysis in static analysis tracks the flow of untrusted user input through code execution paths to sinks, enabling Semgrep rules to detect complex security vulnerabilities like injection flaws across multiple languages.

How do I test Semgrep rules to ensure they match code patterns correctly?▼

You test Semgrep rules by writing explicit test fixtures containing vulnerable and safe code samples, then running the semgrep --test command to validate that the rule triggers only on the intended code patterns.

Does Semgrep support pattern-based detection for multiple programming languages?▼

Yes, Semgrep supports pattern-based detection and taint-mode rules across multiple programming languages, allowing you to write generic syntax patterns that identify security vulnerabilities and code-quality issues consistently.

Why do my Semgrep rules fail to detect the expected code patterns?▼

Semgrep rules fail to detect expected patterns when the syntax matching is too strict or lacks taint-mode configuration, requiring you to write explicit tests and run semgrep --test to debug and refine the rule logic.