Semgrep Rule Variant Creator V2

Semgrep Rule Variant Creator

Overview

This public intake copy packages plugins/antigravity-awesome-skills/skills/semgrep-rule-variant-creator from https://github.com/sickn33/antigravity-awesome-skills into the native Omni Skills editorial shape without hiding its origin.

Use it when the operator needs the upstream workflow, support files, and repository context to stay intact while the public validator and private enhancer continue their normal downstream flow.

This intake keeps the copied upstream files intact and uses the external_source block in metadata.json plus ORIGIN.md as the provenance anchor for review.

Semgrep Rule Variant Creator Port existing Semgrep rules to new target languages with proper applicability analysis and test-driven validation.

Imported source sections that did not map cleanly to the public headings are still preserved below or in the support files. Notable imported sections: Input Specification, Output Specification, Rationalizations to Reject, Strictness Level, Foundational Knowledge, Documentation.

When to Use This Skill

Use this section as the trigger filter. It should make the activation boundary explicit before the operator loads files, runs commands, or opens a pull request.

• Porting an existing Semgrep rule to one or more target languages
• Creating language-specific variants of a universal vulnerability pattern
• Expanding rule coverage across a polyglot codebase
• Translating rules between languages with equivalent constructs
• Creating a new Semgrep rule from scratch (use semgrep-rule-creator instead)
• Running existing rules against code

Operating Table

Workflow

This workflow is intentionally editorial and operational at the same time. It keeps the imported source useful to the operator while still satisfying the public intake standards that feed the downstream enhancer flow.

1. Does the vulnerability class exist in the target language?
2. Does an equivalent construct exist (function, pattern, library)?
3. Are the semantics similar enough for meaningful detection?
4. APPLICABLE → Proceed with variant creation
5. APPLICABLEWITHADAPTATION → Proceed but significant changes needed
6. NOT_APPLICABLE → Skip this language, document why
7. Minimum 2 vulnerable cases (ruleid:)

Imported Workflow Notes

Imported: Four-Phase Workflow

Phase 1: Applicability Analysis

Before porting, determine if the pattern applies to the target language.

Analysis criteria:

1. Does the vulnerability class exist in the target language?
2. Does an equivalent construct exist (function, pattern, library)?
3. Are the semantics similar enough for meaningful detection?

Verdict options:

• APPLICABLE → Proceed with variant creation
• APPLICABLE_WITH_ADAPTATION → Proceed but significant changes needed
• NOT_APPLICABLE → Skip this language, document why

See applicability-analysis.md for detailed guidance.

Phase 2: Test Creation (Test-First)

Always write tests before the rule.

Create test file with target language idioms:

• Minimum 2 vulnerable cases (ruleid:)
• Minimum 2 safe cases (ok:)
• Include language-specific edge cases

// ruleid: sql-injection-golang
db.Query("SELECT * FROM users WHERE id = " + userInput)

// ok: sql-injection-golang
db.Query("SELECT * FROM users WHERE id = ?", userInput)

Phase 3: Rule Creation

1. Analyze AST: semgrep --dump-ast -l <lang> test-file
2. Translate patterns to target language syntax
3. Update metadata: language key, message, rule ID
4. Adapt for idioms: Handle language-specific constructs

See language-syntax-guide.md for translation guidance.

Phase 4: Validation

# Validate YAML
semgrep --validate --config rule.yaml

# Run tests
semgrep --test --config rule.yaml test-file

Checkpoint: Output MUST show All tests passed.

For taint rule debugging:

semgrep --dataflow-traces -f rule.yaml test-file

See workflow.md for detailed workflow and troubleshooting.

Imported: Next Steps

• For applicability analysis guidance, see applicability-analysis.md
• For language translation guidance, see language-syntax-guide.md
• For detailed workflow and examples, see workflow.md

Imported: Overview

This skill guides the creation of language-specific variants of existing Semgrep rules. Each target language goes through an independent 4-phase cycle:

FOR EACH target language:
  Phase 1: Applicability Analysis → Verdict
  Phase 2: Test Creation (Test-First)
  Phase 3: Rule Creation
  Phase 4: Validation
  (Complete full cycle before moving to next language)

Imported: Input Specification

This skill requires:

1. Existing Semgrep rule - YAML file path or YAML rule content
2. Target languages - One or more languages to port to (e.g., "Golang and Java")

Examples

Example 1: Ask for the upstream workflow directly

Use @semgrep-rule-variant-creator-v2 to handle <task>. Start from the copied upstream workflow, load only the files that change the outcome, and keep provenance visible in the answer.

Explanation: This is the safest starting point when the operator needs the imported workflow, but not the entire repository.

Example 2: Ask for a provenance-grounded review

Review @semgrep-rule-variant-creator-v2 against metadata.json and ORIGIN.md, then explain which copied upstream files you would load first and why.

Explanation: Use this before review or troubleshooting when you need a precise, auditable explanation of origin and file selection.

Example 3: Narrow the copied support files before execution

Use @semgrep-rule-variant-creator-v2 for <task>. Load only the copied references, examples, or scripts that change the outcome, and name the files explicitly before proceeding.

Explanation: This keeps the skill aligned with progressive disclosure instead of loading the whole copied package by default.

Example 4: Build a reviewer packet

Review @semgrep-rule-variant-creator-v2 using the copied upstream files plus provenance, then summarize any gaps before merge.

Explanation: This is useful when the PR is waiting for human review and you want a repeatable audit packet.

Best Practices

Treat the generated public skill as a reviewable packaging layer around the upstream repository. The goal is to keep provenance explicit and load only the copied source material that materially improves execution.

• Aspect - semgrep-rule-creator - This skill
• Input - Bug pattern description - Existing rule + target languages
• Output - Single rule+test - Multiple rule+test directories
• Workflow - Single creation cycle - Independent cycle per language
• Phase 1 - Problem analysis - Applicability analysis per language
• Library research - Always relevant - Optional (when original uses libraries)
• Keep the imported skill grounded in the upstream repository; do not invent steps that the source material cannot support.

Imported Operating Notes

Imported: Key Differences from Rule Creation

Troubleshooting

Problem: The operator skipped the imported context and answered too generically

Symptoms: The result ignores the upstream workflow in plugins/antigravity-awesome-skills/skills/semgrep-rule-variant-creator, fails to mention provenance, or does not use any copied source files at all. Solution: Re-open metadata.json, ORIGIN.md, and the most relevant copied upstream files. Check the external_source block first, then restate the provenance before continuing.

Problem: The imported workflow feels incomplete during review

Symptoms: Reviewers can see the generated SKILL.md, but they cannot quickly tell which references, examples, or scripts matter for the current task. Solution: Point at the exact copied references, examples, scripts, or assets that justify the path you took. If the gap is still real, record it in the PR instead of hiding it.

Problem: The task drifted into a different specialization

Symptoms: The imported skill starts in the right place, but the work turns into debugging, architecture, design, security, or release orchestration that a native skill handles better. Solution: Use the related skills section to hand off deliberately. Keep the imported provenance visible so the next skill inherits the right context instead of starting blind.

Related Skills

• @00-andruia-consultant - Use when the work is better handled by that native specialization after this imported skill establishes context.
• @00-andruia-consultant-v2 - Use when the work is better handled by that native specialization after this imported skill establishes context.
• @10-andruia-skill-smith - Use when the work is better handled by that native specialization after this imported skill establishes context.
• @10-andruia-skill-smith-v2 - Use when the work is better handled by that native specialization after this imported skill establishes context.

Additional Resources

Use this support matrix and the linked files below as the operator packet for this imported skill. They should reflect real copied source material, not generic scaffolding.

Imported Reference Notes

Imported: Quick Reference

Imported: Output Specification

For each applicable target language, produces:

<original-rule-id>-<language>/
├── <original-rule-id>-<language>.yaml     # Ported Semgrep rule
└── <original-rule-id>-<language>.<ext>    # Test file with annotations

Example output for porting sql-injection to Go and Java:

sql-injection-golang/
├── sql-injection-golang.yaml
└── sql-injection-golang.go

sql-injection-java/
├── sql-injection-java.yaml
└── sql-injection-java.java

Imported: Rationalizations to Reject

When porting Semgrep rules, reject these common shortcuts:

Imported: Strictness Level

This workflow is strict - do not skip steps:

• Applicability analysis is mandatory: Don't assume patterns translate
• Each language is independent: Complete full cycle before moving to next
• Test-first for each variant: Never write a rule without test cases
• 100% test pass required: "Most tests pass" is not acceptable

Imported: Foundational Knowledge

The semgrep-rule-creator skill is the authoritative reference for Semgrep rule creation fundamentals. While this skill focuses on porting existing rules to new languages, the core principles of writing quality rules remain the same.

Consult semgrep-rule-creator for guidance on:

• When to use taint mode vs pattern matching - Choosing the right approach for the vulnerability type
• Test-first methodology - Why tests come before rules and how to write effective test cases
• Anti-patterns to avoid - Common mistakes like overly broad or overly specific patterns
• Iterating until tests pass - The validation loop and debugging techniques
• Rule optimization - Removing redundant patterns after tests pass

When porting a rule, you're applying these same principles in a new language context. If uncertain about rule structure or approach, refer to semgrep-rule-creator first.

Imported: Documentation

REQUIRED: Before porting rules, read relevant Semgrep documentation:

• Rule Syntax - YAML structure and operators
• Pattern Syntax - Pattern matching and metavariables
• Pattern Examples - Per-language pattern references
• Testing Rules - Testing annotations
• Trail of Bits Testing Handbook - Advanced patterns

Imported: Limitations

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.