The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the semgrep CLI tool to perform rule validation (--validate), testing (--test), and AST analysis (--dump-ast). These operations are local to the rule development environment and are standard for the skill's stated purpose.
[EXTERNAL_DOWNLOADS]: The skill fetches documentation via WebFetch from established repositories including the official Semgrep documentation and the author's (Trail of Bits) testing handbook on GitHub. These downloads are used as reference material for rule syntax and logic.
[INDIRECT_PROMPT_INJECTION]: The skill incorporates an attack surface for indirect prompt injection by reading content from external sources at runtime.
Ingestion points: Fetches seven specific documentation files from GitHub (raw.githubusercontent.com/semgrep/* and raw.githubusercontent.com/trailofbits/*) to provide context for rule creation.
Boundary markers: The instructions do not specify any delimiters or ignore-instructions markers to isolate the fetched documentation from the agent's primary instructions.
Capability inventory: The skill has access to Bash, Write, and Edit tools, which could be misused if the fetched content contained malicious instructions that the agent followed.
Sanitization: No sanitization or validation of the fetched documentation content is mentioned in the instructions.

semgrep-rule-creator