| name | semgrep-rule-variant-creator |
| description | Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language. |
| type | skill |
| created | 2026-02-27T00:00:00.000Z |
| domain | software-development |
| category | testing |
| risk | unknown |
| source | community |
| tags | ["skill","software-development","testing","semgrep","rule","variant"] |
Semgrep Rule Variant Creator
Port existing Semgrep rules to new target languages with proper applicability analysis and test-driven validation.
When to Use
Ideal scenarios:
- Porting an existing Semgrep rule to one or more target languages
- Creating language-specific variants of a universal vulnerability pattern
- Expanding rule coverage across a polyglot codebase
- Translating rules between languages with equivalent constructs
When NOT to Use
Do NOT use this skill for:
- Creating a new Semgrep rule from scratch (use
semgrep-rule-creator instead)
- Running existing rules against code
- Languages where the vulnerability pattern fundamentally doesn't apply
- Minor syntax variations within the same language
Input Specification
This skill requires:
- Existing Semgrep rule - YAML file path or YAML rule content
- Target languages - One or more languages to port to (e.g., "Golang and Java")
Output Specification
For each applicable target language, produces:
<original-rule-id>-<language>/
├── <original-rule-id>-<language>.yaml # Ported Semgrep rule
└── <original-rule-id>-<language>.<ext> # Test file with annotations
Example output for porting sql-injection to Go and Java:
sql-injection-golang/
├── sql-injection-golang.yaml
└── sql-injection-golang.go
sql-injection-java/
├── sql-injection-java.yaml
└── sql-injection-java.java
Rationalizations to Reject
When porting Semgrep rules, reject these common shortcuts:
| Rationalization | Why It Fails | Correct Approach |
|---|
| "Pattern structure is identical" | Different ASTs across languages | Always dump AST for target language |
| "Same vulnerability, same detection" | Data flow differs between languages | Analyze target language idioms |
| "Rule doesn't need tests since original worked" | Language edge cases differ | Write NEW test cases for target |
| "Skip applicability - it obviously applies" | Some patterns are language-specific | Complete applicability analysis first |
| "I'll create all variants then test" |
