What problem does it solve? Porting a Semgrep rule from one programming language to another is error-prone: AST structures differ, equivalent APIs have different semantics, and naive syntax translation produces rules that miss vulnerabilities or generate false positives. This Skill provides a strict, structured workflow for creating correct language variants of existing rules. ## Core Features & Use Cases - Applicability Analysis: Determines whether a vulnerability pattern meaningfully applies to each target language before any porting work begins, with documented verdicts (APPLICABLE, APPLICABLE_WITH_ADAPTATION, NOT_APPLICABLE). - Test-First Porting Workflow: Enforces a four-phase cycle per language—applicability analysis, test creation, rule creation, and validation—requiring 100% test pass before moving to the next language. - Language Translation Guidance: Provides reference material on AST analysis, metavariable adaptation, source/sink/sanitizer translation, and language-specific idioms. - Use Case: You have a Python SQL injection taint rule and need coverage for Go and Java. Provide the rule and target languages, and receive independent rule+test directories (e.g., sql-injection-golang/, sql-injection-java/) with validated, passing tests for each. ## Quick Start Port my existing Semgrep rule python-command-injection.yaml to Go and Java, creating a tested rule variant directory for each applicable language.
