semgrep-rule-creator

Generate Semgrep rules with tests and validation documentation.

31|4|Updated Apr 6, 2026

Search Tags:#workflow #testing #security #static-analysis #semgrep #rule

Ready to run

npx skills add https://github.com/kissrosecicd-hub/agents-evolution --skill semgrep-rule-creator-kissrosecicd-hub

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep-rule-creator
Source: https://github.com/kissrosecicd-hub/agents-evolution/tree/main/.agents/skills/tob-semgrep-rule-creator
Command: npx skills add https://github.com/kissrosecicd-hub/agents-evolution --skill semgrep-rule-creator-kissrosecicd-hub

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Creating Semgrep rules can be slow and error-prone without a repeatable workflow. The Semgrep Rule Creator provides a structured path from problem analysis to a tested, documented rule package, reducing false positives and deployment risk.

Core Features & Use Cases

Guided, test-first rule development that starts from a bug pattern and ends with a validated rule package.
Multi-language support with per-rule test suites, documentation, and example cases to demonstrate how rules behave in real codebases.
Use Case: Developers can rapidly implement a rule to detect a specific vulnerability and verify it against a comprehensive test set before shipping.

Quick Start

Describe a bug pattern you want to detect and follow the workflow to write a single-rule YAML and a matching test, then run Semgrep tests to validate.

Frequently Asked Questions about semgrep-rule-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I write Semgrep rules with tests and reduce false positives?▼

To write Semgrep rules with tests, follow a test-first workflow that analyzes your bug pattern, generates a per-rule YAML set with frontmatter metadata, and validates behavior against a matching test suite to reduce false positives before deployment.

What is the best way to create production-ready static analysis rules for multiple programming languages?▼

Creating production-ready static analysis rules across multiple languages requires a structured workflow that guides you from problem analysis to test-first implementation, enforcing per-rule YAML sets and per-language test suites for an auditable development process.

Can I use a test-first workflow to develop Semgrep rules for real codebases?▼

Yes, you can use a test-first workflow to develop Semgrep rules by describing a bug pattern, writing a single-rule YAML with a matching test, and running Semgrep tests to validate detection behavior against example cases in real codebases.

Does Semgrep rule generation support frontmatter metadata and validation documentation?▼

Semgrep rule generation enforces frontmatter metadata and produces validation documentation, ensuring each rule package maintains a clear, auditable development process with per-rule YAML sets and optional resources for deployment readiness.

Why do my custom static analysis rules keep producing false positives during testing?▼

Custom static analysis rules produce false positives when lacking iterative refinement and comprehensive test suites; applying a guided test-first workflow with per-rule test validation reduces deployment risk by verifying rule behavior before shipping.