What problem does it solve? Generic static analyzers miss project-specific bugs, and LLMs often hallucinate Semgrep's Solidity capabilities. This Skill provides accurate, verified guidance for writing custom Semgrep detection rules in YAML that catch reentrancy, access control flaws, unsafe delegatecall, and other vulnerabilities that generic tools overlook. ## Core Features & Use Cases - Custom Rule Authoring: Write YAML rules using pattern matching, metavariables, ellipsis operators, and taint tracking to detect protocol-specific anti-patterns and invariants. - Community Ruleset Integration: Run the decurity/semgrep-smart-contracts ruleset covering reentrancy, tx.origin auth, unchecked return values, and proxy issues against any contracts directory. - CI/CD and Testing Workflows: Set up GitHub Actions with SARIF upload, pre-commit hooks, rule testing with ruleid/ok annotations, and autofix rules. - Use Case: While auditing a DeFi vault, write a taint-tracking rule that traces user-supplied addresses flowing into delegatecall, test it against annotated Solidity fixtures, then gate pull requests on ERROR-severity findings in CI. ## Quick Start Ask the agent to write a Semgrep rule that detects block.timestamp used as randomness in your contracts directory and test it with semgrep --test.
