semgrep-rule-creator
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill is a standard utility designed to facilitate the creation and validation of Semgrep rules.
- [EXTERNAL_DOWNLOADS]: The skill uses WebFetch to access documentation from semgrep.dev and GitHub. These are recognized as official and trusted sources for the Semgrep tool's documentation.
- [COMMAND_EXECUTION]: The skill guides the agent to run the semgrep command-line tool via Bash for rule testing. This is a functional requirement for verifying the accuracy of generated rules against test files.
- [DYNAMIC_EXECUTION]: The static detector alert for 'eval' is a false positive; the pattern appears only within illustrative code examples and test fixtures in markdown documentation, not as code to be executed by the agent environment.
Audit Metadata