semgrep-rule-variant-creator

Create language-specific variants of Semgrep rules through a four-phase workflow.

1|Updated Jan 31, 2026

Search Tags:#automation #testing #security #semgrep #porting #rule creation

Ready to run

npx skills add https://github.com/allanninal/claude-code-skills --skill semgrep-rule-variant-creator-allanninal

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep-rule-variant-creator
Source: https://github.com/allanninal/claude-code-skills/tree/main/skills/semgrep-rule-variant-creator
Command: npx skills add https://github.com/allanninal/claude-code-skills --skill semgrep-rule-variant-creator-allanninal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of adapting existing Semgrep security rules to function across multiple programming languages, ensuring consistent security analysis in diverse codebases.

Core Features & Use Cases

Cross-Language Rule Porting: Translates Semgrep rules from one language to others, maintaining security detection capabilities.
Test-Driven Development: Enforces a strict test-first methodology for each language variant, ensuring accuracy.
Use Case: You have a critical Semgrep rule written for Python that detects a specific type of injection vulnerability. Use this Skill to port that rule to Go and Java, ensuring your Go and Java codebases are protected by the same high-quality detection logic.

Quick Start

Use the semgrep-rule-variant-creator skill to port the 'sql-injection' Semgrep rule to Golang and Java.

Frequently Asked Questions about semgrep-rule-variant-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I port Semgrep rules across different programming languages?▼

Porting Semgrep rules requires adapting syntax patterns to match language-specific AST structures and idioms. A guided workflow analyzes applicability, creates tests, writes rules, and validates detection logic to maintain security capabilities across diverse codebases.

What is the process for creating language-specific variants of Semgrep security rules?▼

Creating language-specific variants involves a four-phase workflow: applicability analysis, test creation, rule writing, and validation. This test-driven methodology ensures security detection logic functions accurately when translated to a new programming language.

Does porting Semgrep rules to Go or Java require writing tests first?▼

Yes, porting Semgrep rules enforces a strict test-first methodology. You must create tests for each target language variant before rule writing and validation, ensuring the ported security detection logic maintains its accuracy.

Why do my ported Semgrep rules fail to detect vulnerabilities in a different programming language?▼

Ported Semgrep rules often fail when they do not adhere to language-specific idioms and AST structures. Validating each rule variant through a structured workflow ensures syntax patterns correctly match the target language codebase structure.

Can I use a test-driven approach to translate Semgrep rules from Python to other languages?▼

Yes, you can translate Semgrep rules from Python to other languages using a test-driven development approach. The process enforces test creation before writing rules, ensuring security detection capabilities remain consistent across diverse codebases.