semgrep-rule-variant-creator_skill

Overview

This skill creates language-specific variants of existing Semgrep rules to expand detection across polyglot codebases. It ports a source rule into independent rule+test directories for each target language, enforcing applicability analysis and a test-first workflow. The output is ready-to-validate Semgrep YAML and annotated test files per language.

How this skill works

For each requested target language it runs a four-phase cycle: applicability analysis, test creation (test-first), rule translation, and validation. It inspects the original rule, analyzes target-language AST and idioms, generates a test file with vulnerable and safe cases, produces a translated YAML rule, and runs semgrep validation and tests until all tests pass. Each language is handled independently with mandatory documentation of any adaptations or rejections.

When to use it

• Port an existing Semgrep rule to one or more target languages
• Create language-specific variants of a universal vulnerability pattern
• Expand rule coverage across a polyglot repository
• Translate a rule where equivalent language constructs exist
• When you require test-driven validation for each variant

Best practices

• Perform applicability analysis before any translation and document the verdict
• Always write tests first: at least two ruleid cases and two ok cases per language
• Dump and inspect the target language AST to guide pattern translation
• Treat each language as an independent work unit — finish full cycle before moving on
• Require 100% test pass; don’t accept partial success
• Adapt patterns to idioms and library semantics rather than 1:1 syntax translation

Example use cases

• Port a SQL injection rule from Python to Go and Java with language-specific test suites
• Create a JavaScript variant of a file path traversal rule originally written for PHP
• Expand a taint-based rule to cover C# by analyzing equivalent dataflow and APIs
• Translate a high-level vulnerability pattern into multiple language directories for CI-based testing
• Reject a port when the vulnerability class or construct does not exist in the target language