skills.rest
amano--
amano--COMMUNITY
Explore all skills by this author →
WebsiteGitHub

semgrep-rule-creator

Create custom Semgrep rules for detecting security vulnerabilities and bug patterns.

Updated Jan 24, 2026
Search Tags:#static analysis#code analysis#security#vulnerability detection#semgrep#rule creation
One-click install
npx skills add https://github.com/amano--/call-center --skill semgrep-rule-creator-amano
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep-rule-creator
Source: https://github.com/amano--/call-center/tree/main/.gemini/antigravity/skills/trailofbits-security/semgrep-rule-creator
Command: npx skills add https://github.com/amano--/call-center --skill semgrep-rule-creator-amano

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the creation of custom Semgrep rules to detect specific bug patterns and security vulnerabilities in code, improving code quality and security posture.

Core Features & Use Cases

  • Custom Rule Generation: Create tailored Semgrep rules for unique project needs.
  • Taint Mode Analysis: Develop rules to track data flow and detect vulnerabilities like injection flaws.
  • Testing & Validation: Ensures rules are accurate and minimize false positives/negatives.
  • Use Case: You need to detect a specific insecure API usage pattern in your Python codebase that isn't covered by existing Semgrep rules. This Skill guides you through creating a precise rule for it.

Quick Start

Use the semgrep-rule-creator skill to write a new Semgrep rule for detecting insecure deserialization in Python.

Frequently Asked Questions about semgrep-rule-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create custom Semgrep rules for security vulnerabilities?▼

Taint mode analysis in Semgrep tracks data flow from untrusted sources to dangerous sinks to detect injection flaws. This approach is supported for developing custom security rules that require tracing variable propagation through code paths.

How do I write a Semgrep rule for detecting insecure API usage in Python?▼

Testing and validation ensures custom Semgrep rules are accurate and minimize false positives and negatives. This is achieved through a test-driven development approach that iteratively refines pattern matching and taint tracking configurations.

Does Semgrep pattern matching work for detecting custom bug patterns?▼

Semgrep pattern matching works for detecting custom bug patterns by allowing users to write precise syntactic rules targeting specific code structures. This approach is effective for identifying insecure API usage not covered by existing rules.

When should I use taint mode versus pattern matching for static code analysis?▼

Use taint mode for static code analysis when tracking data flow to detect injection vulnerabilities, and use pattern matching for identifying specific syntactic bug patterns. The choice depends on whether the vulnerability requires data flow tracing or structural matching.

Related Skills

Explore More Software Engineering Skills→
sovriumsovrium
3

security-scanner

Identify security vulnerabilities in codebases via static analysis.

Official
Advanced
AmidVoshakulAmidVoshakul

semgrep-rule-creator

Generate custom Semgrep rules using test-first development and AST validation.

Community
Advanced
MolcajeteAIMolcajeteAI
2

security-scanning

Scan Go projects with gosec and govulncheck for security vulnerabilities.

Official
Intermediate
PriyanshKuniyalPriyanshKuniyal

sast-configuration

Configures and manages SAST tools for automated vulnerability detection in CI/CD pipelines.

Community
Advanced