Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

semgrep-rule-variant-creator — Claude Code skill

Ports completed Semgrep rules to selected languages and creates separate rule and test directories. Use it when you already have a rule to adapt.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill semgrep-rule-variant-creator -a claude-code
Open on GitHub

What semgrep-rule-variant-creator does

This skill takes an existing Semgrep rule, target languages, and produces an independent rule directory with tests for each language. Every target goes through its own cycle, including an applicability decision and validation. A language judged inapplicable gets no output directory.

Run the workflow with /semgrep-rule-variant-creator:port-rule-to-languages. It requires rulePath, a languages array, and an absolute referencesDir; outputDir is optional. The reference path matters: relative paths and unexpanded variables are rejected.

The workflow passes the rule by file path instead of copying its text between phases. Its phase order puts tests before rule writing, and validation failures can be retried up to three times.

What it helps with

  • port an existing Semgrep rule to Go
  • create separate rule and test directories
  • check whether a pattern applies to a target language
  • retry validation after a failed check

Example prompts for the agent

  • `/semgrep-rule-variant-creator:port-rule-to-languages` Port `rules/check.yml` to Go using an absolute `referencesDir`.
  • Run `/semgrep-rule-variant-creator:port-rule-to-languages` with `rulePath` set to `rules/check.yml` for Go and Java.
  • Use `/semgrep-rule-variant-creator:port-rule-to-languages` and write variants to `outputDir` `semgrep-variants`.

How to install semgrep-rule-variant-creator

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill semgrep-rule-variant-creator -a claude-code

2Manually: put the files in place

~/.claude/skills/semgrep-rule-variant-creator/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/semgrep-rule-variant-creator/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

arize-ai-provider-integration official arize Manage Arize AI integrations for language model providers: create connections, inspect their settings, and update or remove them. Use it when configuring models for Arize evaluators or other Arize features. GitHub Copilot 1,100installs agent-supply-chain official github Checks AI agent plugins, tools, and dependencies with SHA-256 manifests. Use it before promoting a plugin or auditing its files. GitHub Copilot 1,100installs two-factor-authentication-best-practices better-auth Walks an agent through adding two-factor auth to a Better Auth app: TOTP, codes by email or SMS, backup codes, trusted devices. Claude Code CX Codex Cursor +1 34,200installs vulnerability-scanner sickn33 Guides AI agents through vulnerability assessments using OWASP 2025 standards and attack surface mapping. Useful during pre-release security reviews. Claude Code CX Codex Cursor +1 1,300installs wp-plugin-development WordPress This skill guides WordPress plugin work, from project structure and hooks to admin settings, security checks and release packaging. Claude Code CX Codex Cursor +1 7,900installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs

Questions about semgrep-rule-variant-creator

How do I install semgrep-rule-variant-creator in Codex?

Run npx skills add trailofbits/skills --skill semgrep-rule-variant-creator -a codex. The installed skill file is .agents/skills/semgrep-rule-variant-creator/SKILL.md.

What does semgrep-rule-variant-creator do?

It adapts an existing Semgrep rule for selected languages and creates separate rule and test directories. Each language is assessed independently before the result is validated.

What is required to run a port?

You need the source rule path, target languages, and an absolute referencesDir. outputDir is optional; otherwise output goes to the current working directory.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor