What problem does it solve? Porting a Semgrep rule to another language is error-prone: AST structures differ, equivalent APIs vary, and naive syntax translation produces rules that miss vulnerabilities or flood results with false positives. This Skill enforces a disciplined per-language workflow so each ported variant actually detects the intended vulnerability. ## Core Features & Use Cases - Applicability Analysis: Determines whether a vulnerability pattern (e.g., SQL injection, command injection) meaningfully applies to each target language before any porting work begins. - Test-First Variant Creation: Writes annotated test files (ruleid/ok cases) in the target language before writing the rule, then validates with semgrep --test until all tests pass. - Independent Per-Language Cycles: Produces a separate rule+test directory for each target language, completing the full 4-phase cycle per language. - Use Case: You have a Python taint-mode rule detecting command injection and need Go and Java equivalents. The Skill analyzes applicability, researches exec.Command and Runtime.exec equivalents, and outputs validated python-command-injection-golang and python-command-injection-java directories. ## Quick Start Port my existing Semgrep rule python-sql-injection.yaml to Go and Java, creating tested rule variants for each language.
