semgrep-rule-creator

Automate Semgrep rule creation with a tests-first workflow.

Updated Aug 27, 2026

Search Tags:#testing #security #static-analysis #code-analysis #rules #semgrep

Ready to run

npx skills add https://github.com/aleister1102/skills --skill semgrep-rule-creator-aleister1102

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep-rule-creator
Source: https://github.com/aleister1102/skills/tree/main/semgrep-rule-creator
Command: npx skills add https://github.com/aleister1102/skills --skill semgrep-rule-creator-aleister1102

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Creates production-quality Semgrep rules to detect security vulnerabilities, bug patterns, and code patterns. It guides you through a tests-first workflow to ensure reliable detections and maintainable rules.

Core Features & Use Cases

Iterative rule creation: analyze the problem, write tests first, examine AST structure, write the rule, and iterate until all tests pass.
Supports both taint-mode and pattern-based rules to improve accuracy and reduce false positives.
Use Case: when you need to enforce security and code quality across a codebase by adding targeted Semgrep rules that align with your organization's threat model.

Quick Start

Describe the vulnerability you want to detect and follow the tests-first workflow to craft, test, and optimize a Semgrep rule.

Frequently Asked Questions about semgrep-rule-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create Semgrep rules to detect security vulnerabilities in my code?▼

To create Semgrep rules for security vulnerabilities, use a tests-first workflow: analyze the vulnerability, write test cases, examine AST structure, and iterate on the rule until all tests pass.

What is the best way to write Semgrep rules that reduce false positives?▼

The best way to reduce false positives in Semgrep rules is by using taint-mode and pattern-based approaches, supported by a strict workflow that analyzes AST structure and validates detections against test cases.

Can I use taint mode and pattern-based rules together for static code analysis?▼

Yes, you can use both taint-mode and pattern-based rules for static code analysis. Combining these approaches improves accuracy and reduces false positives when detecting complex code patterns and security vulnerabilities.

How do I test Semgrep rules before deploying them across a codebase?▼

To test Semgrep rules before deployment, follow a tests-first workflow by writing test cases for the target code patterns, then iterating on the rule until all tests pass to ensure robust coverage.

What is the workflow for writing production-grade Semgrep rules?▼

The workflow for writing production-grade Semgrep rules involves analyzing the problem, writing tests first, examining AST structure, writing the rule, and iterating until all tests pass, with guidance for taint mode and pattern-based approaches.

Does this approach support enforcing code quality rules across multiple languages?▼

Yes, this approach supports enforcing security and code quality across a codebase by creating targeted Semgrep rules that align with your organization's threat model, ensuring robust coverage across languages.