Can I use this to create a completely new rule from scratch?

No, this skill is specifically optimized for porting existing logic. For creating entirely new detection patterns, the 'semgrep-rule-creator' skill is recommended.

Which languages does this skill support?

It supports any language that Semgrep officially supports, provided you specify the target language during the input phase.

What is the benefit of the 'test-first' methodology used here?

Writing tests before the rule ensures that the detection logic is validated against concrete code samples, which prevents false positives and ensures the ported rule actually works in the new context.

Does it handle the syntax differences between languages automatically?

Yes, it analyzes the Abstract Syntax Tree (AST) for the target language to ensure that patterns are idiomatically correct and functionally equivalent to the original.

Semgrep Rule Variant Creator

Name: Semgrep Rule Variant Creator
Author: trailofbits

bytrailofbits

•

1,825

•

安全与测试

Ports existing Semgrep rules to multiple programming languages with automated applicability analysis and test-driven validation.

The Semgrep Rule Variant Creator is a specialized skill designed to streamline the expansion of security coverage across polyglot codebases. By taking an existing Semgrep rule and a list of target languages, it executes a rigorous four-phase workflow including applicability analysis, test-driven development, and AST-based rule synthesis. This ensures that every ported rule respects language-specific idioms and security patterns while maintaining 100% test pass rates, making it an essential tool for security researchers and developers performing large-scale vulnerability detection audits.

主要功能

011,825 GitHub stars

02Automatic generation of annotated test files

03Automated cross-language applicability analysis

04Language-specific AST mapping and syntax translation

05Test-driven rule synthesis for high accuracy

06Independent validation cycles per target language

使用场景

01Scaling custom audit rules during organizational shifts to new programming languages

02Translating universal security patterns like SQLi and XSS to new tech stacks

03Expanding vulnerability detection coverage across polyglot microservices

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills semgrep-rule-variant-creator

For use in Claude.ai and ChatGPT

Download Skill