Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

semgrep-rule-creator — Claude Code skill: write static analysis rules

A skill that walks you through creating custom Semgrep rules to detect security vulnerabilities and code patterns in your projects. Use it when you need static analysis tailored to your codebase.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill semgrep-rule-creator -a claude-code
Open on GitHub

What semgrep-rule-creator does

semgrep-rule-creator guides the full Semgrep rule-writing workflow: analyze the problem, write tests first, study the AST structure, create the rule, and iterate until all tests pass using semgrep --test. It requires Semgrep to be installed on your system.

Two core approaches: taint mode for tracking how untrusted input flows to dangerous sinks (more accurate, fewer false positives for injection bugs), and pattern matching for syntactic rules. The skill prioritizes taint mode but lets you switch strategies if one isn't working. Output structure is strict: one folder per rule, containing a YAML file with the rule and a test file annotated with # ruleid: and # ok: markers.

The skill blocks common mistakes: overly broad patterns that match everything, rules without tests on safe cases, skipping AST analysis, optimizing before the rule works. Before writing any rule, it requires fetching Semgrep documentation—seven links covering syntax, testing, and taint analysis.

What it helps with

  • Detect injection vulnerabilities specific to your tech stack
  • Automate checks for internal coding standards and conventions
  • Track dangerous data flows from untrusted sources to unsafe sinks
  • Validate rules on test cases without false positives
  • Extend built-in Semgrep rulesets with domain-specific logic

Example prompts for the agent

  • Write a Semgrep rule to find `eval()` calls with user input
  • Create a taint mode rule that catches SQL injection in Django
  • Write a rule to detect use of weak encryption algorithms

How to install semgrep-rule-creator

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill semgrep-rule-creator -a claude-code

2Manually: put the files in place

~/.claude/skills/semgrep-rule-creator/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/semgrep-rule-creator/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

ralph Yeachan-Heo A persistence loop that works through tasks in prd.json until all stories pass and get reviewer verification. Useful for multi-step jobs that need guaranteed completion. Claude Code CX Codex Cursor +1 971installs react19-test-patterns official github A migration reference for updating test files to work with React 19. Use it when replacing removed test utilities or revising StrictMode call-count assertions. GitHub Copilot 1,200installs mem0-test-integration mem0ai Checks the Mem0 integration that /mem0-integrate left behind: installs dependencies, runs the test suite and a live smoke flow, then prints a scorecard. Claude Code CX Codex Cursor +1 323installs superpowers-lab sickn33 Sets an evaluation workflow to test experimental upstream skills against a baseline in an isolated environment before adopting them. Claude Code CX Codex Cursor +1 1,400installs test-driven-development sickn33 Guides coding agents through a strict test-driven development workflow: red, green, and refactor. Useful when fixing bugs or implementing new features with regression checks. Claude Code CX Codex Cursor +1 1,400installs fix-merge-conflicts cursor Resolves merge conflicts in a branch, then checks the build and tests before wrapping up. Use it when several conflicted files need focused fixes without a refactor. Claude Code CX Codex Cursor +1 2,700installs improve-codebase-architecture Matt Pocock This skill scans a codebase for architectural friction, then builds a visual HTML report with refactoring candidates. Use it before a deeper architecture review. Claude Code 1,163,035installs design-taste-frontend Leonxlnx This skill directs the design of public pages and work screens, then checks the result in a browser through screenshots. Use it when an interface feels generic or unfinished. Claude Code CX Codex Cursor +1 673,100installs

Questions about semgrep-rule-creator

How do I install semgrep-rule-creator in Claude Code?

Run npx skills add trailofbits/skills --skill semgrep-rule-creator -a claude-code in your terminal, then open ~/.claude/skills/semgrep-rule-creator/SKILL.md.

What does semgrep-rule-creator do?

It guides you through the entire Semgrep rule creation process: analyzing the problem, writing tests first, validating with semgrep --test, and ensuring your rule is specific and free of false positives. The skill enforces a strict workflow to keep rules focused and well-tested.

When should I use taint mode versus pattern matching?

Use taint mode for injection vulnerabilities—it tracks data flow from source to sink and catches only real issues. Use pattern matching for simple syntactic patterns. Taint mode typically has fewer false positives but requires understanding how data propagates in your code. The skill starts with taint mode but lets you switch if needed.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor