Trailofbits:Semgrep Rule
Creates Semgrep rules with test-first methodology
- Type
- Slash Command
- Repository
- trailofbits/skills
- GitHub stars
- 7.3k
- License
- CC-BY-SA-4.0
- Repo last updated
- Sep 25, 2026
What Trailofbits:Semgrep Rule is
Trailofbits:Semgrep Rule is a slash command published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”
A slash command is a reusable prompt saved as a markdown file and run by typing its name after a slash. In Claude Code, custom commands have been merged into skills: a file in .claude/commands/ and a skill folder in .claude/skills/ both create the same kind of command, and existing command files keep working.
Trailofbits:Semgrep Rule gives you a repeatable way to run the same instructions without retyping them, optionally with arguments.
How to install Trailofbits:Semgrep Rule
Claude Code
- Download semgrep-rule.md from the repository.
- Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md.
- Run it by typing / followed by its name, with arguments such as (uses conversation context for detection pattern).
Claude Cowork
- Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it.
- In Customize → Skills, click +, then upload the ZIP.
- Run it from any task with / and the skill name.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/semgrep-rule-creator/commands/semgrep-rule.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.
Arguments: $ARGUMENTS
This command is context-driven. Use conversation context to understand:
- The vulnerability or pattern to detect
- The target language
- Whether taint mode is appropriate
If context is unclear, ask for a description of the pattern to detect.
Invoke the semgrep-rule-creator skill for the full workflow.
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Trailofbits:Semgrep Rule?
Trailofbits:Semgrep Rule is a slash command for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Creates Semgrep rules with test-first methodology
How do I install Trailofbits:Semgrep Rule in Claude Code?
Download semgrep-rule.md from the repository. Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md. Run it by typing / followed by its name, with arguments such as (uses conversation context for detection pattern).
Can I use Trailofbits:Semgrep Rule in Claude Cowork?
Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it. In Customize → Skills, click +, then upload the ZIP. Run it from any task with / and the skill name.
Is Trailofbits:Semgrep Rule safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Gh Cli Intercepts GitHub URL fetches (WebFetch and MCP fetch tools) and curl/wget commands, redirecting to the authenticated gh CLI. Plugin · trailofbits/skills
- Git Cleanup Safely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work. Plugin · trailofbits/skills
- Let Fate Decide Draws the 12 Houses of the Zodiac Tarot spread using cryptographic randomness to add 100+ bits of entropy to vague or underspecified planning. Interprets the spread to guide next steps. Use when feeling lucky, invoking heart-of-the-cards energy, or when prompts are ambiguous. Plugin · trailofbits/skills
- Insecure Defaults Detects insecure default configurations including hardcoded credentials, fallback secrets, weak authentication defaults, and dangerous values in production Plugin · trailofbits/skills
- Trailofbits:Spec Compliance Verifies code implements specification requirements Slash Command · trailofbits/skills
- Trailofbits:Scan Apk Scans Android APKs for Firebase security misconfigurations Slash Command · trailofbits/skills
- Trailofbits:Variants Finds similar vulnerabilities using pattern-based analysis Slash Command · trailofbits/skills
- Trailofbits:Entry Points Identifies state-changing entry points in smart contracts Slash Command · trailofbits/skills