How does the skill handle different programming languages?

The skill uses Semgrep's AST dumping capability to analyze how specific code is parsed, allowing it to create accurate patterns regardless of the target programming language's syntax.

Does this skill require me to write tests for my rules?

Yes, this skill follows a strict 'test-first' workflow. It requires creating test files with specific annotations to verify that the rule correctly identifies bugs and ignores safe code.

Can I use this skill to run existing Semgrep scans?

This skill is specialized for creating and optimizing new, custom rules. For running standard, pre-existing rulesets, you should use a general static analysis or linting plugin.

What is the benefit of using taint mode in Semgrep rules?

Taint mode tracks the flow of data from untrusted sources to dangerous sinks, which helps distinguish between safe hardcoded values and potentially malicious user input, drastically reducing false positives.

Semgrep Rule Creator

Name: Semgrep Rule Creator
Author: fjor1025

byfjor1025

0•

安全与测试

Generates production-quality Semgrep rules for security vulnerability detection and code pattern matching using a test-driven workflow.

The Semgrep Rule Creator skill empowers developers and security engineers to build, test, and optimize custom Semgrep rules directly within their environment. It enforces a rigorous, documentation-backed methodology that prioritizes taint-mode for data flow analysis and utilizes AST (Abstract Syntax Tree) inspection to ensure patterns are both precise and robust. By mandating a test-first approach, it ensures that every rule is validated against both positive and negative cases, significantly reducing false positives and ensuring reliable detection of security flaws and bug patterns.

主要功能

010 GitHub stars

02Test-driven rule development with mandatory validation checkpoints

03Advanced taint-mode support for tracking complex data flows

04AST structure analysis for high-precision pattern matching

05Integration with official Semgrep documentation for syntax accuracy

06Automatic pattern optimization and redundancy removal

使用场景

01Identifying injection vulnerabilities through untrusted data flow analysis

02Enforcing organization-specific coding standards and architectural patterns

03Building custom security detectors for proprietary libraries and frameworks

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add fjor1025/infosec-framework semgrep-rule-creator

For use in Claude.ai and ChatGPT

Download Skill