---
name: "semgrep-custom-rules-engine"
description: "Author semantic, pattern-based static analysis rules in YAML to catch bugs and vulnerabilities."
metadata:
  author: "Semgrep"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "write custom semgrep rule"
  - "author sast rule yaml"
  - "taint analysis semgrep"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Semgrep Custom SAST Rules Engine

Writes Semgrep custom rule patterns: pattern, pattern-inside, pattern-not, metavariable regex matching, taint mode propagation, and automated CI integration.

## When to Invoke
Invoke this skill whenever you need to:
- write custom semgrep rule
- author sast rule yaml
- taint analysis semgrep

## Execution SOP & Rules
1. Structure rules using valid YAML syntax with id, message, severity, languages, and pattern keys.
2. Use metavariables ($VAR) to match arbitrary expressions and capture values across patterns.
3. Use pattern-inside to constrain detection to specific functions or request handler scopes.
4. Test custom rules against positive and negative test cases to eliminate false alarms.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.