Semgrep Rule Variant Creator

A Claude Code skill for porting existing Semgrep rules to new target languages with proper applicability analysis and test-driven validation.

Overview

This skill takes an existing Semgrep rule and one or more target languages, then generates independent rule variants for each applicable language. Each variant goes through a complete 4-phase cycle:

1. Applicability Analysis - Determine if the vulnerability pattern applies to the target language
2. Test Creation - Write test-first with vulnerable and safe cases
3. Rule Creation - Translate patterns and adapt for target language idioms
4. Validation - Ensure all tests pass before proceeding

Components

The split follows what needs a person. Which rule to port, which languages to target, and whether to accept a language being dropped are decisions the skill puts to you, and a workflow cannot ask questions mid-run — which is exactly why those questions come first. Everything after that is the same four phases over many languages, so it runs as a workflow, with the phase order and the retry bound held in code rather than in prose.

Prerequisites

• Semgrep installed and available in PATH
• Existing Semgrep rule to port (in YAML)
• Target languages specified
• Dynamic workflows enabled — [Claude Code v2.1.154 or later, on any paid plan](https://code.claude.com/docs/en/workflows). Where they are unavailable the slash command does not exist and the skill falls back to running phases by hand

Usage

Porting is the same four phases repeated per language, so the orchestration ships as a dynamic workflow:

/semgrep-rule-variant-creator:port-rule-to-languages

It reads the rule once, then runs each language through its own applicability, test, translation, and validation cycle, and reports which languages passed, which failed validation, which were not applicable, and which Semgrep cannot analyze at all — Perl has no frontend and Elixir's parser is Pro-only, and in both cases the bug class is present while the rule is ungradeable. Validation is measured against one specific Semgrep, the version recorded when the rule was read, because "All tests passed" is also what Semgrep prints for a rule it skipped and for a test file it never matched. Two annotations is the floor on both sides of a spec, and the ok: side is counted by a second Semgrep run over it, because --test --json reports the lines the rule matched and nothing about the lines it must leave alone — so vulnerable cases alone grade clean for a rule that flags every construct in the target language. The script pins a reasoning effort per phase and encodes the phase order, so a rule cannot be written before the tests that specify it. It also sends a NOT_APPLICABLE verdict to an independent refuter before dropping a language, and retries failed validation up to three times instead of trusting one agent to iterate until the tests pass.

The skill also triggers on a plain request, for porting a single language by hand:

Port the sql-injection.yaml Semgrep rule to Go and Java

Create Semgrep rule variants of my-rule.yaml for TypeScript, Rust, and C#

Create the same Semgrep rule for JavaScript and Ruby

Port this Semgrep rule to Golang

Output Structure

For each applicable target language, the skill produces:

<original-rule-id>-<language>/
├── <original-rule-id>-<language>.yaml     # Ported rule
└── <original-rule-id>-<language>.<ext>    # Test file