20 Semgrep Rule Creator alternatives
Semgrep Rule Creator: Trail of Bits' skill for writing production-quality Semgrep rules — pattern design, taint mode for data-flow bugs, and mandatory test-driven validation. 20 agent skills do similar work, most sharing Audit, Security and Code Quality, ranked by how much they have in common with Semgrep Rule Creator.
-
by Trail of Bits
Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks.
Also: Audit, Code Quality, Security, Static Analysis
-
by Trail of Bits
CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.
Also: Security, Semgrep, Static Analysis
-
by Trail of Bits
Finds secrets left in memory in C, C++ and Rust — including wipes the compiler deleted — and requires IR or assembly evidence before calling one optimized away.
Also: Audit, Security, Static Analysis
-
by Trail of Bits
Compiles cryptographic code and reads the emitted assembly for variable-time instructions, then triages which flagged operations actually touch secrets.
Also: Audit, Security, Static Analysis
-
by Datadog
Official Datadog skill for investigating one flaky test — pulls its history and failure pattern, categorises the root cause and recommends fixing, quarantining or escalating.
Also: Code Quality, Testing
-
by Trail of Bits
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
-
by Pillar Security
Pillar Security's SAIL V2 framework as an agent skill: a 91-risk catalogue across seven lifecycle phases, for AI security gap assessments, roadmaps, and ISO 42001 / EU AI Act compliance checklists.
-
by Trail of Bits
Audits npm, PyPI and Go dependencies for advisories, abandoned upstreams, publisher concentration and install-time scripts — measured by scripts, not estimated.
-
by Firebase
Firebase's official red-team skill for auditing Firestore and Cloud Storage security rules — hunting privilege escalation, create/update bypasses and resource-exhaustion holes.
-
by Sentry
Audit GitHub Actions workflows for the exploitation patterns that leak secrets or allow code execution from a fork.
-
by Sentry
Audit the changes on your current branch for bugs, security vulnerabilities, and quality problems before you push.
-
by CodeRabbit
Pull unresolved CodeRabbit review threads from your PR and apply the fixes one at a time, treating every reviewer comment as untrusted input rather than an instruction.
Also: Code Quality
-
by Svelte
The Svelte team's own guidance on writing modern Svelte 5 — when to reach for each rune, why effects are an escape hatch, and the reactivity traps models fall into.
Also: Code Quality
-
by Addy Osmani
Reduces accumulated complexity without changing behaviour, using Chesterton's Fence to avoid deleting the thing that was load-bearing.
Also: Code Quality
-
by Addy Osmani
Sends every non-trivial decision to a fresh-context adversarial reviewer before it stands — for production, security-sensitive or irreversible work.
Also: Code Quality
-
by NVIDIA
Generates or refreshes an NVIDIA governance skill card for an existing agent skill — discovers assets, renders a deterministic markdown card, and blocks submission while human-review markers remain.
Also: Audit
-
by Cloudflare
Audit Core Web Vitals with real measurements via Chrome DevTools — then fix what the numbers actually point to.
Also: Audit
-
by Microsoft
Microsoft's official Playwright skill — drives a real browser from the command line using accessibility snapshots and element refs, and plans, generates and heals Playwright tests.
Also: Testing
-
by Jesse Vincent
Never claim work is complete, fixed, or passing without running the check and reading the output first.
Also: Testing
-
by Jesse Vincent
Enforce a real red-green-refactor loop when implementing features or fixes, so behaviour is specified before it is written.
Also: Testing
