Plugin

Semgrep Rule Creator

Create custom Semgrep rules for detecting bug patterns and security vulnerabilities

Type: Plugin
Repository: trailofbits/skills
GitHub stars: 7.3k
License: CC-BY-SA-4.0
Repo last updated: Sep 25, 2026
Source file: plugins/semgrep-rule-creator/.claude-plugin/plugin.json
Version: 1.2.6
Author: Maciej Domanski

What Semgrep Rule Creator is

Semgrep Rule Creator is a plugin published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”

A plugin is a package that bundles skills, slash commands, subagents, hooks, and MCP connectors so they install together. Plugins are plain files with a manifest at .claude-plugin/plugin.json, and they work in both Claude Code and Claude Cowork.

Installing Semgrep Rule Creator adds everything it ships in one step. Connectors inside a plugin still need to be connected separately, and hooks and subagents only run in Cowork and Claude Code, not in regular chat.

How to install Semgrep Rule Creator

Claude Code

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills
Install the plugin: claude plugin install semgrep-rule-creator@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json.
Restart the session if the new skills or commands don't appear straight away.

Claude Cowork

Open Customize → Plugins and choose Add marketplace.
Enter trailofbits/skills (the owner/repo shorthand works for GitHub).
Find Semgrep Rule Creator in the list, click Install, then connect any connectors it needs from its Connectors tab.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/semgrep-rule-creator/.claude-plugin/plugin.json, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.

Create production-quality Semgrep rules for detecting bug patterns and security vulnerabilities.

Author: Maciej Domanski

Skills Included

When to Use

Use this skill when you need to:

Create custom Semgrep rules for detecting specific bug patterns
Write rules for security vulnerability detection
Build taint mode rules for data flow analysis
Develop pattern matching rules for code quality checks

What It Does

Guides test-driven rule development (write tests first, then iterate)
Analyzes AST structure to help craft precise patterns
Supports both taint mode (data flow) and pattern matching approaches
Includes comprehensive reference documentation from Semgrep docs
Provides common vulnerability patterns by language

Prerequisites

Semgrep installed (uv tool install semgrep or brew install semgrep)

Installation

/plugin install trailofbits/skills/plugins/semgrep-rule-creator

Then run /semgrep-rule-creator:semgrep-rule to walk through building a rule.

Related Skills

semgrep-rule-variant-creator - Port existing Semgrep rules to new target languages
static-analysis - General static analysis toolkit with Semgrep, CodeQL, and SARIF parsing
variant-analysis - Find similar vulnerabilities across codebases

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Semgrep Rule Creator?

Semgrep Rule Creator is a plugin for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Create custom Semgrep rules for detecting bug patterns and security vulnerabilities

How do I install Semgrep Rule Creator in Claude Code?

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills Install the plugin: claude plugin install semgrep-rule-creator@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json. Restart the session if the new skills or commands don't appear straight away.

Can I use Semgrep Rule Creator in Claude Cowork?

Open Customize → Plugins and choose Add marketplace. Enter trailofbits/skills (the owner/repo shorthand works for GitHub). Find Semgrep Rule Creator in the list, click Install, then connect any connectors it needs from its Connectors tab.

Is Semgrep Rule Creator safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under CC-BY-SA-4.0. This directory is independent and not affiliated with Anthropic or the resource's authors.