mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
mschwager
8655937ac0
* Add some improvements to semgrep-rule-creator * Bump second version location * Use raw GH markdown for docs links * Fix YAML indentation for by-side-effect in Focus example The by-side-effect key was at column 3 (same as the list dash), causing a YAML parse error. Moved to column 5 to be part of the list item mapping alongside patterns. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix invalid by-side-effect value in taint options example The pseudo-syntax (true|only) is not valid YAML and is rejected by semgrep --validate. Use a real value with a comment documenting the alternative. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Wrap multi-line comment example in inline code backticks Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add missing pattern-sources to taint mode anti-pattern example Taint mode requires both pattern-sources and pattern-sinks. Without sources, semgrep --validate rejects the rule. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix review issues: restore {baseDir} paths, improve quick-reference clarity - Restore {baseDir} in SKILL.md and workflow.md path references per repo convention - Normalize YAML indentation in focus-metavariable taint example - Preserve behavioral description in by-side-effect comment - Rename ambiguous "Operators" section to "Matching Operators" Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Maciej Domanski <maciej.domanski@trailofbits.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
Semgrep Rule Creator
Create production-quality Semgrep rules for detecting bug patterns and security vulnerabilities.
Author: Maciej Domanski
Skills Included
| Skill | Purpose |
|---|---|
semgrep-rule-creator |
Guide creation of custom Semgrep rules with testing |
When to Use
Use this skill when you need to:
- Create custom Semgrep rules for detecting specific bug patterns
- Write rules for security vulnerability detection
- Build taint mode rules for data flow analysis
- Develop pattern matching rules for code quality checks
What It Does
- Guides test-driven rule development (write tests first, then iterate)
- Analyzes AST structure to help craft precise patterns
- Supports both taint mode (data flow) and pattern matching approaches
- Includes comprehensive reference documentation from Semgrep docs
- Provides common vulnerability patterns by language
Prerequisites
- Semgrep installed (
pip install semgreporbrew install semgrep)
Installation
/plugin install trailofbits/skills/plugins/semgrep-rule-creator
Related Skills
semgrep-rule-variant-creator- Port existing Semgrep rules to new target languagesstatic-analysis- General static analysis toolkit with Semgrep, CodeQL, and SARIF parsingvariant-analysis- Find similar vulnerabilities across codebases