What problem does it solve? Writing custom Semgrep rules that accurately detect vulnerabilities without false positives is difficult, and untested rules silently miss bugs or flood teams with noise. This Skill enforces a test-first, iterative workflow so every rule is validated against vulnerable and safe code cases before delivery. ## Core Features & Use Cases - Test-First Rule Creation: Write annotated test files (ruleid/ok) before the rule, then iterate with semgrep --test until all tests pass. - Taint Mode Guidance: Prioritizes taint mode for data flow vulnerabilities, tracking untrusted input from sources to dangerous sinks with sanitizers. - AST Analysis & Optimization: Uses semgrep --dump-ast to understand code structure and removes redundant patterns after tests pass. - Use Case: You need to detect every place user-controlled input reaches os.system() in a Python codebase. The Skill guides you to write a taint-mode rule, build test cases covering sanitized and unsafe flows, and verify zero false positives. ## Quick Start Ask the AI to create a Semgrep rule that detects a specific vulnerability pattern in your language, with tests validating both vulnerable and safe code examples.
