Co-Pilot / 辅助式

更新于 a month ago

semgrep-rule-creator

Name: semgrep-rule-creator
Rating: 3.8 (1828 reviews)
Author: trailofbits

Ttrailofbits

1.8k

trailofbits/skills/plugins/semgrep-rule-creator

Agent 评分

💡 摘要

一个用于创建和测试自定义 Semgrep 规则以检测缺陷和安全漏洞的 AI 引导助手。

🎯 适合人群

应用安全工程师DevSecOps 工程师专注于代码质量的软件开发人员安全研究人员

🤖 AI 吐槽: “这就像给抽象语法树写正则表达式的 GPS——但如果你不熟悉这片领域，依然很容易迷路。”

安全分析低风险

该技能指导创建执行 Semgrep 的规则，Semgrep 会进行本地文件系统读取和代码执行。恶意构造的规则模式可能通过复杂匹配导致拒绝服务。缓解措施：在无网络访问的沙箱环境中运行代理和 Semgrep。

Semgrep Rule Creator

Create production-quality Semgrep rules for detecting bug patterns and security vulnerabilities.

Author: Maciej Domanski

Skills Included

| Skill | Purpose | |-----------------------|------------------------------------------------------| | semgrep-rule-creator | Guide creation of custom Semgrep rules with testing |

When to Use

Use this plugin when you need to:

Create custom Semgrep rules for detecting specific bug patterns
Write rules for security vulnerability detection
Build taint-mode rules for data flow analysis
Develop pattern-matching rules for code quality checks

What It Does

Guides test-driven rule development (write tests first, then iterate)
Analyzes AST structure to help craft precise patterns
Supports both taint mode (data flow) and pattern matching approaches
Includes comprehensive reference documentation from Semgrep docs
Provides common vulnerability patterns by language

Prerequisites

Semgrep installed (pip install semgrep or brew install semgrep)

Installation

/plugin install trailofbits/skills/plugins/semgrep-rule-creator

Related Skills

semgrep-rule-variant-creator - Port existing Semgrep rules to new target languages
static-analysis - General static analysis toolkit with Semgrep, CodeQL, and SARIF parsing
variant-analysis - Find similar vulnerabilities across codebases

五维分析

清晰度8/10

创新性6/10

实用性9/10

完整性7/10

可维护性8/10

优缺点分析

优点

提倡测试驱动的规则开发方法。
支持模式匹配和复杂的污点分析规则。
集成了全面的 Semgrep 文档。

缺点

需要预先安装 Semgrep 并具备相关知识。
受限于 Semgrep 的规则语法和能力。
效果取决于用户描述代码模式的能力。