Which programming languages are supported?

It supports any language that Semgrep itself supports, provided there is a valid AST mapping for the target pattern and the vulnerability class exists in that language.

Can this skill create new rules from scratch?

No, this skill is specifically designed for porting existing rules to new languages; you should use 'semgrep-rule-creator' for generating entirely new detection patterns.

What happens if a vulnerability pattern doesn't apply to a target language?

The skill includes a mandatory applicability analysis phase that will return a 'NOT_APPLICABLE' verdict, skipping the porting process and documenting the technical reasons why.

Why does it require a test-first approach?

A test-first approach ensures that the ported rule correctly identifies vulnerabilities and avoids false positives by validating against language-specific idioms before the rule is finalized.

Semgrep Rule Variant Creator

Name: Semgrep Rule Variant Creator
Author: monmacllcapp

bymonmacllcapp

0•

安全与测试

Ports existing Semgrep security and quality rules to new target languages using a rigorous, test-driven validation workflow.

The Semgrep Rule Variant Creator is a specialized tool designed to expand security coverage across polyglot codebases by porting existing Semgrep rules to multiple target languages. It follows a strict four-phase workflow—including applicability analysis, test-driven development, AST-based rule creation, and mandatory validation—to ensure that detection logic remains accurate and idiomatically correct across different programming environments. This skill is essential for security engineers and developers who need to maintain consistent vulnerability detection patterns across diverse tech stacks without manually rewriting every rule from scratch.

主要功能

01Independent rule and test directory generation for each target language

02Strict validation workflow requiring 100% test pass rates

03Test-first rule generation with mandatory vulnerable and safe cases

040 GitHub stars

05Automatic AST dumping for precise cross-language pattern matching

06Multi-language applicability analysis and verification

使用场景

01Maintaining consistent SAST standards across microservices using different languages

02Porting known security patterns (like SQL injection) from Python to Go and Java

03Expanding a custom vulnerability library to support a new internal tech stack

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add monmacllcapp/skill-forks semgrep-rule-variant-creator

For use in Claude.ai and ChatGPT

Download Skill