The Agent Skills Directory

[SAFE]: The skill is a set of documentation and guidelines for using the semgrep CLI tool to author static analysis rules. It does not include any executable scripts or hidden logic that could compromise a system.
[EXTERNAL_DOWNLOADS]: The skill fetches Semgrep documentation from its official GitHub repository (github.com/semgrep/semgrep-docs) and a reputable security handbook from Trail of Bits (github.com/trailofbits/testing-handbook). These are trusted sources for security documentation.
[COMMAND_EXECUTION]: The skill provides legitimate instructions for using the semgrep CLI tool, such as --test, --validate, and --dump-ast. These are standard developer tools used for static analysis and do not represent a privilege escalation or persistence risk.
[PROMPT_INJECTION]: While the skill contains instructional language like 'IMPORTANT' and 'REQUIRED', these are used to guide the user through a strict development workflow and do not attempt to bypass AI safety filters or override system instructions.
[DYNAMIC_EXECUTION]: The skill mentions eval() and os.system() in the context of writing detection patterns (e.g., creating a rule to find where eval is used). It does not instruct the agent to execute code dynamically or use eval for its own operations.

semgrep-rule-creator