skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

semgrep-rule-creator

Creates and tests custom Semgrep rules for detecting security vulnerabilities and code patterns.

Updated Apr 5, 2026
Search Tags:#static analysis#sast#pattern matching#semgrep#rule creation#security vulnerabilities#taint mode
One-click install
npx skills add https://github.com/marumo333/atrox --skill semgrep-rule-creator-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep-rule-creator
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/semgrep-rule-creator/skills/semgrep-rule-creator
Command: npx skills add https://github.com/marumo333/atrox --skill semgrep-rule-creator-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Writing Semgrep rules that accurately detect vulnerabilities without false positives or false negatives is difficult, and untested rules erode trust in static analysis results. ## Core Features & Use Cases - Test-First Rule Creation: Enforces writing annotated test files (ruleid/ok) before the rule, then iterating with semgrep --test until all tests pass. - Taint Mode Guidance: Prioritizes taint mode for data flow vulnerabilities, tracking untrusted input from sources to dangerous sinks to reduce false positives. - AST-Based Pattern Design: Uses semgrep --dump-ast to understand how Semgrep parses code, ensuring patterns match syntactic variations. - Use Case: You need to detect all cases where user-controlled request data reaches eval() in a Python codebase. The skill guides you to write a taint mode rule with sources, sinks, and sanitizers, plus tests covering vulnerable, sanitized, and hardcoded-safe cases. ## Quick Start Ask the AI to create a Semgrep rule that detects a specific vulnerability pattern in your language, including a test file with ruleid and ok annotations.

Frequently Asked Questions about semgrep-rule-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a custom Semgrep rule to detect vulnerabilities?▼

Write test cases first with ruleid and ok annotations covering vulnerable and safe code, then analyze the AST with semgrep --dump-ast, write the rule, and iterate with semgrep --test until all tests pass.

When should I use Semgrep taint mode instead of pattern matching?▼

Use taint mode when data flows from untrusted input to a dangerous sink, such as injection vulnerabilities. Pattern matching fits simple syntactic patterns without data flow requirements, but produces more false positives on safe cases.

How do I test a Semgrep rule for false positives?▼

Run semgrep --test --config <rule-id>.yaml <rule-id>.<ext> from the rule directory. Include ok annotations for safe cases like sanitized inputs and hardcoded values to verify they do not match.

Why is my Semgrep taint rule not propagating?▼

Run semgrep --dataflow-traces to see the flow path. Common causes include overly broad sanitizer patterns, source patterns that do not match, or incorrect focus-metavariable on sinks.

What test annotations are allowed in Semgrep rule test files?▼

Only ruleid: <rule-id> and ok: <rule-id> annotations are allowed, placed on the line immediately before the code. The todoruleid and todook annotations are forbidden, and multi-line comment annotations should not be used.

When should I not use this Semgrep rule creation approach?▼

Do not use it for running existing Semgrep rulesets or general static analysis without custom rules. It is specifically for authoring new detection rules, not executing scans with pre-built rules.

Related Skills

Explore More Software Engineering Skills→
superagent-aisuperagent-ai
76

security-disclosure-triage

Evaluate security advisories against repository checkouts and assign severity.

Official
Advanced
jakubciszakjakubciszak
1

semgrep

Apply Semgrep rules to identify security issues across multi-language codebases.

Community
Advanced
ayehiaaayehiaa

semgrep

Run Semgrep static analysis scans and merge SARIF results.

Community
Advanced
elizaOSelizaOS
19.0k

codeql

Perform static security analysis with CodeQL queries and data flow tracking.

Official
Advanced