semgrep-rule-creator

An agent skill by trailofbits, from trailofbits/skills. Tags: code-quality, developer-tools, security, semgrep.

What it does

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill semgrep-rule-creator

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/semgrep-rule-creator/skills/semgrep-rule-creator ~/.claude/skills/semgrep-rule-creator

Safety box score

Grade B, low risk: 21 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill creates and tests Semgrep rules, so it will run local Semgrep commands and write rule/test files in the workspace. The main risks are bounded execution and outbound fetches to live documentation URLs; there is no sign of secret handling, privilege escalation, or autonomous actions beyond analysis and rule generation.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs local commands such as `semgrep --test`, `semgrep --validate`, `semgrep --dump-ast`, and `semgrep --dataflow-traces`, which executes the Semgrep engine against files in the working tree.
Network access	2 (moderate)	It requires WebFetch to read seven remote docs, including `raw.githubusercontent.com/...` and `trailofbits/...` URLs, so it makes outbound requests and depends on fetched content.
Filesystem reach	1 (low)	The workflow writes a rule directory with exactly two files, e.g. `Output structure - exactly 2 files in a directory named after the rule-id`, which is workspace-scoped file creation.
Secrets & credentials	0 (none)	No step reads or requests tokens, passwords, `.env` files, keychains, browser sessions, or CLI logins.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, shell startup editing, or OS/git setting change in the skill.
Instruction hijack surface	0 (none)	The files do not instruct the agent to ignore higher-priority rules, hide behavior, or follow untrusted remote instructions; they only direct it to fetch documentation and follow a testing workflow.
Irreversible actions	0 (none)	It does not push, publish, send messages, pay, book, or delete anything; it only creates and validates Semgrep rules.
Transparency	1 (low)	The required documentation is fetched from live `refs/heads/main` URLs, so the exact guidance used at runtime is outside the repo and can change over time.

Before installing

Confirm you are comfortable granting local command execution for `semgrep --test`, `--validate`, and AST/dataflow debugging.
Check the required WebFetch URLs; they use live `refs/heads/main` docs, so the guidance may change over time.
Verify the skill will only write `<rule-id>/<rule-id>.yaml` and one test file in the workspace.

Rated 2026-10-20 by an automated review of 5 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/semgrep-rule-creator/skills/semgrep-rule-creator/SKILL.md
Branch: main
Collection: semgrep-rule-creator
Updated: 2026-09-19

c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
semgrep-rule-variant-creator — Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages.
code-reviewer — Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.