semgrep-rule-creator

This skill helps developers create custom Semgrep rules for detecting security vulnerabilities, bug patterns, and enforcing coding standards in codebases. It focuses on building high-quality static analysis rules that go beyond simple pattern matching, ensuring detections are accurate and actionable. By guiding users through a structured workflow, it reduces common mistakes such as overly broad rules, missed edge cases, or untested logic. The goal is to produce reliable Semgrep rules that can be safely used in production environments without introducing excessive false positives or negatives.

Key capabilities include a strict test-first workflow where rules must be validated before use, ensuring both vulnerable and safe cases are covered. It emphasizes iterative development: analyzing code structure, writing tests first, implementing rules, and refining them until all tests pass. The skill supports both pattern-based rules and taint mode rules, with a strong preference for taint analysis when tracking untrusted input flow to sensitive sinks. It also highlights common anti-patterns such as overly broad matching, incomplete test coverage, and premature optimization. Users are guided to inspect AST representations when needed to ensure patterns correctly match real code structures. Additionally, it enforces structural constraints like one rule per YAML file and discourages generic or low-specificity configurations.

Typical users include security engineers, AppSec teams, and developers responsible for code quality and vulnerability detection. It is especially useful when building custom detectors for proprietary codebases or organization-specific coding standards. It is also valuable in CI pipelines where precise static analysis rules are required to prevent regressions and security issues.