Agent skill · software engineering · sickn33
semgrep-rule-variant-creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
Why this skill is useful
Adds specific procedures for porting Semgrep rules across languages, including applicability analysis and test-driven validation that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Semgrep Rule Variant Creator Port existing Semgrep rules to new target languages with proper applicability analysis and test-driven validation. When to Use Ideal scenarios: Porting an existing Semgrep rule to one or more target languages Creating language-specific variants of a universal vulnerability pattern Expanding rule coverage across a polyglot codebase Translating rules between languages with equivalent constructs When NOT to Use Do NOT use this skill for: Creating a new Semgrep rule from scratch (use semgrep-rule-creator instead) Running existing rules against code Languages where the vulnerability pattern fundamentally doesn't apply Minor syntax variations within the same language Input Specification This skill requires: 1. Existing Semgrep rule - YAML file path or YAML rule content 2. Target languages - One or more languages to port to (e.g., "Golang and Java") Output Specification For each applicable target language, produces: Example output for porting sql-injection to Go and Java: Rationalizations to Reject When porting Semgrep rules, reject these common shortcuts: Rationalization Why It Fails Correct Approach ----------------- -------------- ------------------ "Pattern structure is identical" Different ASTs across languages Always dump AST for target language "Same vulnerability, same detection" Data flow differs between languages Analyze target language idioms "Rule doesn't need tests since original worked" Language edge cases differ Write NEW test cases for target "Skip applicability - it obviously applies" Some patterns are language-specific Complete applicability analysis first "I'll create all variants then test" Errors compound, hard to debug Complete full cycle per language "Library equivalent is close enough" Surface similarity hides differences Verify API semantics match "Just translate the syntax 1:1" Languages have different idioms Research target language patterns Strictness Level This workflow is strict - do not skip steps: Applicability a …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/semgrep-rule-variant-creator--39a1a4