Agent skill · Trail of Bits
Semgrep Rule Creator
Officialname: semgrep-rule-creator★ 7.8k (repo)pushed 2026-10-24CC-BY-SA-4.0SKILL.md on GitHubchecked 2026-10-24
Install
The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs
npx skills add trailofbits/skills --skill semgrep-rule-creator
This repo is a plugin marketplace. Inside Claude Code, add it and install the plugin that holds the skill (audit-context-building, building-secure-contracts, burpsuite-project-parser, chrome-mcp-troubleshooting...), or copy only this skill into ~/.claude/skills. docs
/plugin marketplace add trailofbits/skills /plugin install <plugin>@trailofbits # or only this skill: npx skills add trailofbits/skills --skill semgrep-rule-creator -a claude-code
Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs
git clone --depth 1 https://github.com/trailofbits/skills.git /tmp/semgrep-rule-creator-src cp -r /tmp/semgrep-rule-creator-src/plugins/semgrep-rule-creator/skills/semgrep-rule-creator ./semgrep-rule-creator zip -r semgrep-rule-creator.zip semgrep-rule-creator
Codex reads skills from .agents/skills in the repo or ~/.agents/skills. Type $ in Codex to use one. docs
npx skills add trailofbits/skills --skill semgrep-rule-creator -a codex
gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs
gh skill install trailofbits/skills semgrep-rule-creator
Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs
npx skills add trailofbits/skills --skill semgrep-rule-creator -a cursor
Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs
gemini skills install https://github.com/trailofbits/skills.git --path plugins/semgrep-rule-creator/skills/semgrep-rule-creator
OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs
npx skills add trailofbits/skills --skill semgrep-rule-creator -a opencode
Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs
npx skills add trailofbits/skills --skill semgrep-rule-creator -a windsurf
More from trailofbits/skills
- Agentic Actions Auditor: Audits GitHub Actions workflows that run AI agents for prompt-injection and privilege risks.
- CodeQL Scan: Builds a CodeQL database and runs data-flow and taint analysis to find vulnerabilities.
- Constant-Time Analysis: Finds timing side channels in cryptographic code, such as branches on secret values.
- Differential Security Review: Security review of a diff that weighs blast radius, call sites and test coverage of changed code.
- Modern Python Tooling: Sets up Python projects with uv, ruff and ty, or migrates from pip, Poetry and mypy.
- Property-Based Testing: Writes and debugs property-based tests with Hypothesis, fast-check, proptest and similar tools.
- Sharp Edges: Flags error-prone APIs, risky defaults and footgun designs that invite security mistakes.
Other security & auth skills
- Security Best Practices Review · OpenAI
- Security Threat Model · OpenAI
- Sign In With Google (Web) · Google
- Security Review (Sentry) · Sentry
- Firebase Security Rules Auditor · Firebase (Google)
- Better Auth Best Practices · Better Auth
- Create Auth (Better Auth) · Better Auth
- Clerk Next.js Patterns · Clerk
FAQ
How do I install the semgrep-rule-creator skill?+
Run npx skills add trailofbits/skills --skill semgrep-rule-creator and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/semgrep-rule-creator/SKILL.md.
Which agents can use Semgrep Rule Creator?+
Any agent that reads the Agent Skills format (SKILL.md): Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.
Who maintains Semgrep Rule Creator?+
Trail of Bits, the company or project behind it, in the trailofbits/skills repo on GitHub, last pushed 2026-10-24.
Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. All agent skills · MCP servers