Regex Builder

Skill: Regex Builder

Construct and explain regular expressions incrementally with test cases and plain-English documentation.

Trigger

When the user asks to build, create, explain, debug, or optimize a regular expression.

Prerequisites

• [ ] Target pattern or matching criteria described
• [ ] Sample inputs (should match and should NOT match)
• [ ] Target language/flavor (JavaScript, Python, Go, PCRE)

Steps

Step 1: Clarify Requirements

• [ ] What should the regex match? (exact description)
• [ ] What should it NOT match? (edge cases)
• [ ] Capture groups needed? (which parts to extract)
• [ ] Flags needed? (case-insensitive, multiline, global, dotall)
• [ ] Performance constraints? (large input, many matches)

Step 2: Build Incrementally

Start with the simplest pattern that matches, then refine:

1. Literal match — match the exact string first
2. Character classes — generalize with [a-z], \d, \w
3. Quantifiers — add +, *, {n,m} for repetition
4. Anchors — add ^, $ for position
5. Groups — add () for captures, (?:) for non-capturing
6. Alternation — add | for OR logic
7. Lookahead/behind — add (?=), `(?https?):\/\/(?[a-zA-Z0-9.-]+)(?::(?\d{1,5}))?(?\/[^\s?#])?(?:\?(?[^\s#]))?(?:#(?\S*))?$

Breakdown: ^ Start of string (?https?) Capture "http" or "https" :\/\/ Literal "://" (?[a-zA-Z0-9.-]+) Capture domain name (?::(?\d{1,5}))? Optional port number (1-5 digits) (?\/[^\s?#])? Optional path starting with / (?:\?(?[^\s#]))? Optional query string after ? (?:#(?\S*))? Optional fragment after # $ End of string

### Step 4: Create Test Cases

✅ Should match: "https://example.com" → protocol=https, domain=example.com "http://api.example.com:8080/v1/users" → port=8080, path=/v1/users "https://example.com/search?q=test#top" → query=q=test, fragment=top

❌ Should NOT match: "ftp://example.com" → wrong protocol "not-a-url" → no protocol "" → empty string

### Step 5: Validate Edge Cases
- [ ] Empty input
- [ ] Very long input (ReDoS risk)
- [ ] Unicode characters
- [ ] Special regex characters in input (`.`, `*`, `+`, `?`)
- [ ] Newlines and whitespace

### Step 6: Check for ReDoS Vulnerability
Avoid catastrophic backtracking patterns:
- **Dangerous:** `(a+)+`, `(a|a)+`, `(a+b?)+` on non-matching input
- **Safe:** Use atomic groups, possessive quantifiers, or rewrite
- If pattern has nested quantifiers on overlapping character classes → flag as risky

### Step 7: Provide Language-Specific Usage

**JavaScript:**
```javascript
const pattern = /^https?:\/\/[a-zA-Z0-9.-]+/;
const match = url.match(pattern);
const isValid = pattern.test(url);

Python:

import re
pattern = re.compile(r'^https?://[a-zA-Z0-9.-]+')
match = pattern.match(url)
is_valid = bool(pattern.match(url))

Go:

pattern := regexp.MustCompile(`^https?://[a-zA-Z0-9.-]+`)
match := pattern.FindString(url)
isValid := pattern.MatchString(url)

Common Patterns Reference

| Need | Pattern | Notes | |------|---------|-------| | Email (basic) | ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ | Not RFC-compliant, covers 99% | | UUID | ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ | Case-insensitive flag | | ISO date | ^\d{4}-\d{2}-\d{2}$ | Doesn't validate ranges | | Semantic version | ^v?\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?$ | Optional v prefix | | IP address (v4) | ^(\d{1,3}\.){3}\d{1,3}$ | Doesn't validate 0–255 | | Slug | ^[a-z0-9]+(-[a-z0-9]+)*$ | Lowercase with hyphens |

Rules

• ALWAYS explain each component in plain English
• ALWAYS provide test cases (match and non-match)
• ALWAYS check for ReDoS vulnerability on complex patterns
• NEVER use regex for HTML parsing — use a proper parser
• Prefer readability over cleverness — comment complex patterns
• Use named capture groups when extracting data
• Mention flavor differences (JS vs Python vs Go) when they matter

Completion

Working regex with plain-English breakdown, test cases, language-specific usage, and ReDoS safety check.

If a Step Fails

• Can't express requirement in regex: Consider a parser or multi-step validation instead
• ReDoS risk detected: Rewrite with non-overlapping character classes or use a timeout
• Flavor mismatch: Note which features are unavailable (e.g., lookbehind in older JS)
• Too complex: Split into multiple simpler patterns applied sequentially

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: girijashankarj
• Source: girijashankarj/cursor-handbook
• License: MIT

Install and usage instructions live in the source repository linked above.