Semgrep Rule Creator
技能 已验证 活跃Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.
To empower developers and security professionals to create effective and reliable Semgrep rules for detecting vulnerabilities and code patterns.
功能
- Guided Semgrep rule creation workflow
- Emphasis on test-first methodology
- Guidance on pattern matching and taint mode
- AST analysis for precise rule writing
- Optimization and validation steps
使用场景
- Writing custom Semgrep rules for specific security vulnerabilities
- Developing rules to enforce coding standards
- Creating taint mode rules for data flow analysis
- Building custom static analysis detections
非目标
- Running existing Semgrep rulesets
- General static analysis without custom rule development
- Skipping testing or validation steps
- Creating overly broad or generic rules
安装
请先添加 Marketplace
/plugin marketplace add trailofbits/skills/plugin install semgrep-rule-creator@trailofbits质量评分
已验证类似扩展
Migrate Validate
100Validate pending migrations for foreign key consistency, rollback safety, and best practices
Moyu (摸鱼)
100감지된 과잉 엔지니어링 패턴: (1) 사용자가 명시적으로 요청하지 않은 코드나 파일을 수정할 때 (2) 요청되지 않은 새로운 추상화 계층(클래스, 인터페이스, 팩토리, 래퍼)을 생성할 때 (3) 요청되지 않은 주석, 문서, JSDoc, 타입 주석을 추가할 때 (4) 요청되지 않은 새로운 종속성을 도입할 때 (5) 최소 편집 대신 파일 전체를 다시 작성할 때 (6) diff 범위가 사용자의 요청을 명백히 초과할 때 (7) 사용자가 "너무 많아", "거기는 건드리지 마", "X만 변경해", "간단하게", "그만"과 같은 신호를 보낼 때 (8) 발생할 수 없는 시나리오에 대한 오류 처리, 유효성 검사, 방어적 코드를 추가할 때 (9) 요청되지 않은 테스트, 설정 스캐폴딩, 문서를 생성할 때
Safe Mode
100Prevent destructive operations using Claude Code hooks. Three modes — cautious (warn on dangerous commands), lockdown (restrict edits to one directory), and clear (remove restrictions). Uses PreToolUse matchers for Bash, Edit, and Write.
Fixflow
100使用严格的交付工作流执行编码任务：构建完整计划、分步实现、持续运行测试，并默认在每一步 (`per_step`) 后提交。当用户要求行为驱动交付或需求不明确时，支持显式提交策略覆盖 (`final_only`, `milestone`) 和可选的 BDD（给定/当/则）。
Ship Gate
100Pre-production audit that scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues. Intercepts deploy commands and blocks until critical items pass. Stack-agnostic. Use for "run ship gate", "am I ready to ship", "pre-launch audit", "can I deploy", "push to production", "go live checklist", "preflight check". Not for CI/CD setup or infra provisioning.
Semgrep
75Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases.