skills.rest
kissrosecicd-hub
kissrosecicd-hubCOMMUNITY
Explore all skills by this author →
GitHub

semgrep-rule-creator

Generate Semgrep rules with tests and validation documentation.

31|4|Updated Apr 6, 2026
Search Tags:#workflow#testing#security#static-analysis#semgrep#rule
One-click install
npx skills add https://github.com/kissrosecicd-hub/agents-evolution --skill semgrep-rule-creator-kissrosecicd-hub
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep-rule-creator
Source: https://github.com/kissrosecicd-hub/agents-evolution/tree/main/.agents/skills/tob-semgrep-rule-creator
Command: npx skills add https://github.com/kissrosecicd-hub/agents-evolution --skill semgrep-rule-creator-kissrosecicd-hub

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Creating Semgrep rules can be slow and error-prone without a repeatable workflow. The Semgrep Rule Creator provides a structured path from problem analysis to a tested, documented rule package, reducing false positives and deployment risk.

Core Features & Use Cases

  • Guided, test-first rule development that starts from a bug pattern and ends with a validated rule package.
  • Multi-language support with per-rule test suites, documentation, and example cases to demonstrate how rules behave in real codebases.
  • Use Case: Developers can rapidly implement a rule to detect a specific vulnerability and verify it against a comprehensive test set before shipping.

Quick Start

Describe a bug pattern you want to detect and follow the workflow to write a single-rule YAML and a matching test, then run Semgrep tests to validate.

Frequently Asked Questions about semgrep-rule-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write Semgrep rules with tests and reduce false positives?▼

To write Semgrep rules with tests, follow a test-first workflow that analyzes your bug pattern, generates a per-rule YAML set with frontmatter metadata, and validates behavior against a matching test suite to reduce false positives before deployment.

What is the best way to create production-ready static analysis rules for multiple programming languages?▼

Creating production-ready static analysis rules across multiple languages requires a structured workflow that guides you from problem analysis to test-first implementation, enforcing per-rule YAML sets and per-language test suites for an auditable development process.

Can I use a test-first workflow to develop Semgrep rules for real codebases?▼

Yes, you can use a test-first workflow to develop Semgrep rules by describing a bug pattern, writing a single-rule YAML with a matching test, and running Semgrep tests to validate detection behavior against example cases in real codebases.

Does Semgrep rule generation support frontmatter metadata and validation documentation?▼

Semgrep rule generation enforces frontmatter metadata and produces validation documentation, ensuring each rule package maintains a clear, auditable development process with per-rule YAML sets and optional resources for deployment readiness.

Why do my custom static analysis rules keep producing false positives during testing?▼

Custom static analysis rules produce false positives when lacking iterative refinement and comprehensive test suites; applying a guided test-first workflow with per-rule test validation reduces deployment risk by verifying rule behavior before shipping.

Related Skills

Explore More Software Engineering Skills→
phuhao00phuhao00
12

code-analyst-agent

Analyze source code to identify symbols, call graphs, and architectural patterns.

Community
Intermediate
roderikroderik
54

rr-solidity

Review Solidity smart contracts for security vulnerabilities using Foundry.

Community
Advanced
ollieb89ollieb89

sast-configuration

Configures SAST tools like Semgrep, SonarQube and CodeQL for automated vulnerability detection in CI/CD pipelines.

Community
Advanced
chrismcmackenchrismcmacken

create-semgrep-rule

Create custom Semgrep rules with metadata and tests for vulnerability detection.

Community
Advanced