Agent Skills
› mtarcure/claude-vibe-squad
› semgrep-rule-author
semgrep-rule-author
GitHub将已确认的缺陷模式转化为可复用的 Semgrep 检测规则。通过编写语法或污点分析规则，结合项目特定清理器过滤误报，并测量仓库范围的误报率，确保规则精准有效且具备版本追溯能力。
Trigger Scenarios
需要为已确认的安全漏洞编写自动化检测规则
需要将特定的代码缺陷模式转化为可复用的 Semgrep 规则
Install
npx skills add mtarcure/claude-vibe-squad --skill semgrep-rule-author -g -y
SKILL.md
Frontmatter
{
"name": "semgrep-rule-author",
"audience": "specialist",
"description": "Use after a defect pattern is confirmed and you need a reusable Semgrep detector for sibling instances: derive syntactic or taint rules from vulnerable and safe fixtures, encode project sanitizers, and measure repository-wide false positives. Not for choosing generic rulesets or scanning only a change."
}
Semgrep Rule Author
Turn a confirmed defect pattern into a Semgrep rule that finds its siblings without drowning the caller in false positives.
Steps
- Start from a confirmed instance, not from an idea. Write down the minimal vulnerable snippet and the minimal safe snippet that must not match.
- Decide the rule's shape: syntactic
patternfor a fixed misuse,patternswithpattern-inside/pattern-notfor context-dependent misuse, andmode: taintwithpattern-sources/pattern-sinkswhen the defect is a data-flow problem rather than a shape. - Prefer taint mode for injection classes. A syntactic rule for a data-flow bug produces the false-positive rate that gets rules disabled.
- Write
pattern-notclauses for the sanitizers and safe wrappers this codebase actually uses; generic sanitizer lists miss project-specific ones. - Use metavariables to bind the attacker-controlled value and
metavariable-patternto constrain it, so the rule expresses the condition rather than the syntax. - Set
severityand write amessagethat names the consequence and the fix, not the pattern. The message is what a reader acts on. - Test against a corpus: the known instances must all match, the known-safe snippets must not, and a full run over the repo must have a triageable hit count.
- Measure and record the false-positive rate on that run. A rule shipped without a measured rate is unverified.
- Version the rule with the defect class it came from, so
variant-analysiscan reuse it and future reviewers know its provenance.
Acceptance
- The rule was derived from a confirmed instance, with vulnerable and safe fixtures committed alongside.
- Data-flow defects use taint mode rather than syntactic matching.
- Project-specific sanitizers are excluded via
pattern-not. - All known instances match, all safe fixtures do not, and the repo-wide false-positive rate is measured and recorded.
- The message states consequence and fix, and the rule records its originating defect class.
Version History
- d5262e2 Current 2026-09-11 11:38
