semgrep-rule-variant-creator

Porting Semgrep rules to multiple languages requires analyzing per-language applicability and generating test-first variants. This skill translates existing vulnerability rules into language-specific variants using AST-informed pattern translation and validates them with Semgrep test success criteria.

Test-first generation for static analysis rules involves creating language-specific test files with vulnerable (ruleid) and safe (ok) cases before writing the rule. This approach ensures edge scenarios are covered and the ported Semgrep rule accurately detects the intended vulnerability class.

Yes, you can translate a universal vulnerability pattern across equivalent constructs by applying AST-informed pattern translation. The process requires generating independent rule and test directories for each applicable target language to ensure clean organization and validated detections.

Determining if a vulnerability class exists in a target language requires per-language applicability analysis. This skill evaluates whether the vulnerability meaningfully exists in the target language and documents a verdict for each language before generating any rule variants.

Ported Semgrep rules fail validation when AST translation is inaccurate or test cases are incomplete. Successful porting requires generating test files with both vulnerable and safe cases, using AST dumps to guide pattern translation, and running Semgrep validate to ensure all tests pass.

Yes, Semgrep rule porting works for polyglot codebases by creating independent rule and test directories per applicable target language. This workflow applies per-language applicability verdicts and test-first validation to expand rule coverage across multiple languages cleanly.