Can I use this to create rules from scratch?

No, this skill is specifically optimized for porting existing rules. For creating entirely new rules from a bug description, you should use the 'semgrep-rule-creator' skill.

What does applicability analysis involve?

It is a mandatory phase where the skill determines if a specific vulnerability class or code pattern actually exists or has an equivalent construct in the target language before attempting to port it.

Does it support all Semgrep-compatible languages?

Yes, it can port rules to any language supported by Semgrep, provided the vulnerability pattern is applicable to the target language's architecture.

What is the Semgrep Rule Variant Creator?

It is a Claude Code skill designed to help developers port existing Semgrep rules to different programming languages while maintaining high detection quality and consistency.

Why does the skill require a test-first approach?

Writing tests before the rule ensures that the detection logic is verified against language-specific idioms and edge cases, preventing false positives and negatives in the target language.

Semgrep Rule Variant Creator

Name: Semgrep Rule Variant Creator
Author: fjor1025

byfjor1025

0•

보안 및 테스팅

Ports existing Semgrep security rules to new programming languages with automated applicability analysis and test-driven validation.

The Semgrep Rule Variant Creator is a specialized tool for developers and security engineers who need to maintain consistent vulnerability detection across polyglot codebases. It automates the complex process of translating Semgrep rules between languages by performing deep Abstract Syntax Tree (AST) analysis and ensuring that ported patterns respect language-specific idioms. By enforcing a strict four-phase workflow—Applicability Analysis, Test-First Creation, Rule Generation, and Validation—the skill ensures that every new rule variant is robust, accurate, and fully verified against real-world code examples before deployment.

주요 기능

01Automated AST dumping for precise language-specific pattern matching

020 GitHub stars

03Standardized output of rule files and annotated test cases

04Multi-language applicability analysis and feasibility verdicts

05Independent cycle processing for multiple target languages

06Strict test-driven development (TDD) workflow for rule validation

사용 사례

01Translating universal vulnerability patterns across a diverse enterprise codebase

02Adapting community Semgrep rules to match internal language-specific coding standards

03Expanding existing Python security rules to cover Go and Java microservices

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add fjor1025/infosec-framework semgrep-rule-variant-creator

For use in Claude.ai and ChatGPT

Download Skill