Can I use this to create a completely new rule from scratch?

No, this skill is specifically optimized for porting existing logic. For creating entirely new detection patterns, the 'semgrep-rule-creator' skill is recommended.

Which languages does this skill support?

It supports any language that Semgrep officially supports, provided you specify the target language during the input phase.

What is the benefit of the 'test-first' methodology used here?

Writing tests before the rule ensures that the detection logic is validated against concrete code samples, which prevents false positives and ensures the ported rule actually works in the new context.

Does it handle the syntax differences between languages automatically?

Yes, it analyzes the Abstract Syntax Tree (AST) for the target language to ensure that patterns are idiomatically correct and functionally equivalent to the original.

Semgrep Rule Variant Creator

Name: Semgrep Rule Variant Creator
Author: trailofbits

bytrailofbits

•

1,825

安全与测试

Ports existing Semgrep rules to multiple programming languages with automated applicability analysis and test-driven validation.

关于

The Semgrep Rule Variant Creator is a specialized skill designed to streamline the expansion of security coverage across polyglot codebases. By taking an existing Semgrep rule and a list of target languages, it executes a rigorous four-phase workflow including applicability analysis, test-driven development, and AST-based rule synthesis. This ensures that every ported rule respects language-specific idioms and security patterns while maintaining 100% test pass rates, making it an essential tool for security researchers and developers performing large-scale vulnerability detection audits.

主要功能

1,825 GitHub stars
Automatic generation of annotated test files
Automated cross-language applicability analysis
Language-specific AST mapping and syntax translation
Test-driven rule synthesis for high accuracy
Independent validation cycles per target language

使用场景

Scaling custom audit rules during organizational shifts to new programming languages
Translating universal security patterns like SQLi and XSS to new tech stacks
Expanding vulnerability detection coverage across polyglot microservices

关于

主要功能

1,825 GitHub stars
Automatic generation of annotated test files
Automated cross-language applicability analysis
Language-specific AST mapping and syntax translation
Test-driven rule synthesis for high accuracy
Independent validation cycles per target language

使用场景

Scaling custom audit rules during organizational shifts to new programming languages
Translating universal security patterns like SQLi and XSS to new tech stacks
Expanding vulnerability detection coverage across polyglot microservices