What problem does it solve? Generic static analyzers miss project-specific bugs and anti-patterns in Solidity code, and LLMs often hallucinate Semgrep's Solidity capabilities. This Skill provides accurate guidance for writing custom Semgrep detection rules, taint tracking, autofixes, and CI/CD integration tailored to smart contract security. ## Core Features & Use Cases - Custom Rule Authoring: Write YAML rules using patterns, metavariables, pattern-either/not/inside operators, and taint tracking to detect reentrancy, tx.origin auth, unsafe delegatecall, unchecked return values, and unsafe downcasts. - Community Rulesets & Testing: Run the decurity/semgrep-smart-contracts ruleset, validate rules with annotated ruleid:/ok: test files, and apply autofix replacements. - CI/CD Integration: Set up GitHub Actions with SARIF upload, pre-commit hooks, Makefile targets, and differential PR scanning. - Use Case: While auditing a DeFi vault, write a taint-tracking rule that traces user-controlled addresses into delegatecall sinks, test it against annotated Solidity fixtures, then gate pull requests on ERROR-severity findings in GitHub Actions. ## Quick Start Ask the agent to write a Semgrep rule that detects block.timestamp used as randomness in your contracts directory and test it with semgrep --test.
