Agent skill · software engineering · sickn33
semgrep-rule-creator
Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
Why this skill is useful
Adds domain-specific knowledge for writing effective Semgrep rules that detect security vulnerabilities and bug patterns.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Semgrep Rule Creator Create production-quality Semgrep rules with proper testing and validation. When to Use Ideal scenarios: Writing Semgrep rules for specific bug patterns Writing rules to detect security vulnerabilities in your codebase Writing taint mode rules for data flow vulnerabilities Writing rules to enforce coding standards When NOT to Use Do NOT use this skill for: Running existing Semgrep rulesets General static analysis without custom rules (use static-analysis skill) Rationalizations to Reject When writing Semgrep rules, reject these common shortcuts: "The pattern looks complete" → Still run semgrep --test --config <rule-id>.yaml <rule-id>.<ext> to verify. Untested rules have hidden false positives/negatives. "It matches the vulnerable case" → Matching vulnerabilities is half the job. Verify safe cases don't match (false positives break trust). "Taint mode is overkill for this" → If data flows from user input to a dangerous sink, taint mode gives better precision than pattern matching. "One test is enough" → Include edge cases: different coding styles, sanitized inputs, safe alternatives, and boundary conditions. "I'll optimize the patterns first" → Write correct patterns first, optimize after all tests pass. Premature optimization causes regressions. "The AST dump is too complex" → The AST reveals exactly how Semgrep sees code. Skipping it leads to patterns that miss syntactic variations. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/semgrep-rule-creator