Can this skill help with data flow vulnerabilities?

Yes, it prioritizes taint mode for tracking untrusted user input from sources to dangerous sinks like eval() or system calls, ensuring precise vulnerability detection.

Which programming languages are supported?

It supports all programming languages compatible with Semgrep. The skill encourages language-specific rules over generic patterns for better accuracy.

Does it support testing of the generated rules?

Absolutely. The skill enforces a strict 'test-first' methodology, requiring validation against both vulnerable cases and safe cases to prevent false positives and negatives.

How does it help reduce false positives in security scans?

By requiring 'ok' test annotations and favoring taint mode over simple syntax matching, the skill ensures that rules only trigger when data actually flows into a dangerous context.

Semgrep Rule Creator

Name: Semgrep Rule Creator
Author: lingxling

bylingxling

•

Security & Testing

Builds production-grade Semgrep rules for automated security vulnerability detection and custom code pattern analysis.

The Semgrep Rule Creator skill empowers developers to build, test, and optimize custom static analysis rules within Claude. It streamlines the creation of complex security detections using both pattern matching and taint mode analysis, ensuring high precision and low false-positive rates. By following a strict iterative workflow that mandates test-first development and AST analysis, this skill helps teams enforce coding standards, identify bug patterns, and catch domain-specific vulnerabilities before they reach production.

Key Features

0146 GitHub stars

02Custom Semgrep rule generation with standardized YAML output.

03Iterative validation workflow to ensure 100% test pass rates.

04Advanced taint mode support for tracking data flow from sources to sinks.

05Automated test file generation with comprehensive rule-id and ok annotations.

06AST-based pattern matching for deep code structure analysis.

Use Cases

01Automating the enforcement of internal coding standards and architectural patterns across large codebases.

02Identifying deprecated API usage or migrating legacy code patterns with high precision.

03Developing custom security rules to detect proprietary or domain-specific vulnerabilities.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add lingxling/awesome-skills-cn semgrep-rule-creator

For use in Claude.ai and ChatGPT

Key Features

0146 GitHub stars

02Custom Semgrep rule generation with standardized YAML output.

03Iterative validation workflow to ensure 100% test pass rates.

04Advanced taint mode support for tracking data flow from sources to sinks.

05Automated test file generation with comprehensive rule-id and ok annotations.

06AST-based pattern matching for deep code structure analysis.

Use Cases

01Automating the enforcement of internal coding standards and architectural patterns across large codebases.

02Identifying deprecated API usage or migrating legacy code patterns with high precision.

03Developing custom security rules to detect proprietary or domain-specific vulnerabilities.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add lingxling/awesome-skills-cn semgrep-rule-creator

For use in Claude.ai and ChatGPT