semgrep-rule-variant-creator
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a structured development process for creating Semgrep rule variants. It relies on local tool execution (semgrep) and standard file operations. All documented commands and patterns are consistent with the skill's stated purpose of static analysis rule development.- [COMMAND_EXECUTION]: The skill instructs the agent to use the semgrep CLI for tasks like dumping ASTs and validating rules. These operations are performed on local files created by the agent and do not involve remote code execution or unsafe command construction.- [PROMPT_INJECTION]: The skill processes user-provided Semgrep rules as input for porting. While this creates a surface for indirect prompt injection, the skill includes strict validation steps and a structured workflow that mitigates the risk of accidental obedience to embedded instructions.
Audit Metadata