xgrep-rule-creator: the cost model for taint rules

[chris-rock]

The skill covers correctness thoroughly and says nothing about what a rule costs to run — "Step 5: Optimize" is about simplifying patterns, not runtime. So a rule can pass every test in the workflow and still be a defect.

What's added

The one thing an author can act on at authoring time: engines pre-filter candidate files using the literal tokens in your sink pattern, and that gate dies silently when the sink is punctuation or a short type keyword. When it can't engage, cost is driven entirely by how often the source matches.

So the pathological shape needs both halves:

a source that matches everywhere + a sink with no distinctive literal

Either alone is fine — a broad source is cheap when the sink gates, and a syntax-only sink is cheap when the source is rare. That conjunction is the part that isn't obvious.

SKILL.md

• new anti-pattern: "A taint rule whose sink has no distinctive literal", showing & $V flowing into *((int*)$P) — a sink whose only token is int, too short and common to filter on
• new rationalization to reject: "It passes the tests, so it's done"

references/workflow.md (Step 5)

• how to measure, with --time and a snippet that ranks rules by seconds-per-finding
• why seconds-per-finding is the sort key: two rules with the same total cost aren't comparable if one returns thousands of findings and the other zero, yet total time ranks them adjacent
• three questions to ask before shipping a taint rule, the first being "what literal token would an engine pre-filter my sink on?" — if the answer is "none", expect it to visit every file

The guardrail

Recorded explicitly, because acting on this data invites the wrong fix:

A rule that finds nothing may still be correct. The flaw may genuinely be absent from that codebase. What's wrong is the cost of reaching that answer — so make the negative answer cheap, never delete or weaken the rule.

Notes

• Both YAML examples parse.
• Branched off current main (has xgrep-rule-creator: document the silent-failure anti-patterns #11) and applied surgically rather than overwriting, since my working copy predated that work.

🤖 Generated with Claude Code

[mondoo-code-review]

Adds documentation on taint rule cost modeling with clear guidance on performance profiling.