semgrep-rule-variant-creator

Name: semgrep-rule-variant-creator
Availability: InStock
Author: Vigolium

Port Semgrep rules into language-specific variants with validated tests.

965|142|Updated Mar 8, 2026

Search Tags:#static analysis #multi-language #vulnerability detection #test-first #semgrep #rule porting #AST translation

Ready to run

npx skills add https://github.com/vigolium/vigolium --skill semgrep-rule-variant-creator-vigolium

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep-rule-variant-creator
Source: https://github.com/vigolium/vigolium/tree/main/platform/vigolium-audit/src/content/skills/semgrep-rule-variant-creator
Command: npx skills add https://github.com/vigolium/vigolium --skill semgrep-rule-variant-creator-vigolium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you port an existing Semgrep rule to new target languages without breaking detection intent, by forcing per-language applicability analysis and test-first validation.

Core Features & Use Cases

Language applicability analysis: Determines whether the vulnerability class meaningfully exists in the target language and documents a verdict for each language.
Test-first variant generation: Produces new language-specific test files with both vulnerable (ruleid) and safe (ok) cases, including edge scenarios.
AST-informed rule creation and validation: Guides rule translation using AST dumps and requires Semgrep validation plus “All tests passed” before finishing.
Multi-language output: Creates independent rule+test directories per applicable target language for clean organization and iteration.

Quick Start

Use the semgrep-rule-variant-creator skill to take an existing Semgrep rule and port it to the languages you specify, generating separate ported rule and test directories for each applicable language with tests that must pass.

Frequently Asked Questions about semgrep-rule-variant-creator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I port Semgrep rules to support multiple programming languages?▼

Porting Semgrep rules to multiple languages requires analyzing per-language applicability and generating test-first variants. This skill translates existing vulnerability rules into language-specific variants using AST-informed pattern translation and validates them with Semgrep test success criteria.

What is test-first generation for static analysis rule porting?▼

Test-first generation for static analysis rules involves creating language-specific test files with vulnerable (ruleid) and safe (ok) cases before writing the rule. This approach ensures edge scenarios are covered and the ported Semgrep rule accurately detects the intended vulnerability class.

Can I use Semgrep to translate a universal vulnerability pattern across equivalent language constructs?▼

Yes, you can translate a universal vulnerability pattern across equivalent constructs by applying AST-informed pattern translation. The process requires generating independent rule and test directories for each applicable target language to ensure clean organization and validated detections.

How do I know if a vulnerability class meaningfully exists in a target language before expanding Semgrep rule coverage?▼

Determining if a vulnerability class exists in a target language requires per-language applicability analysis. This skill evaluates whether the vulnerability meaningfully exists in the target language and documents a verdict for each language before generating any rule variants.

Why do my ported Semgrep rules fail validation when expanding to new languages?▼

Ported Semgrep rules fail validation when AST translation is inaccurate or test cases are incomplete. Successful porting requires generating test files with both vulnerable and safe cases, using AST dumps to guide pattern translation, and running Semgrep validate to ensure all tests pass.

Does Semgrep rule porting work for polyglot codebases with mixed language targets?▼

Yes, Semgrep rule porting works for polyglot codebases by creating independent rule and test directories per applicable target language. This workflow applies per-language applicability verdicts and test-first validation to expand rule coverage across multiple languages cleanly.