semgrep-rule-variant-creator by trailofbits/skills
npx skills add https://github.com/trailofbits/skills --skill semgrep-rule-variant-creator将现有的 Semgrep 规则移植到新的目标语言,并提供适当的适用性分析和测试驱动的验证。
理想场景:
请勿在以下情况使用此技能:
semgrep-rule-creator)此技能需要:
对于每个适用的目标语言,生成:
<original-rule-id>-<language>/
├── <original-rule-id>-<language>.yaml # 移植后的 Semgrep 规则
└── <original-rule-id>-<language>.<ext> # 带注解的测试文件
将 sql-injection 移植到 Go 和 Java 的示例输出:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
sql-injection-golang/
├── sql-injection-golang.yaml
└── sql-injection-golang.go
sql-injection-java/
├── sql-injection-java.yaml
└── sql-injection-java.java
移植 Semgrep 规则时,请拒绝以下常见的捷径:
| 理由 | 为何失败 | 正确方法 |
|---|---|---|
| "模式结构完全相同" | 不同语言的抽象语法树不同 | 始终为目标语言转储抽象语法树 |
| "相同的漏洞,相同的检测方法" | 数据流在不同语言间存在差异 | 分析目标语言的惯用写法 |
| "规则不需要测试,因为原始规则有效" | 语言的边界情况不同 | 为目标语言编写新的测试用例 |
| "跳过适用性分析 - 它显然适用" | 某些模式是语言特定的 | 首先完成适用性分析 |
| "我将创建所有变体然后测试" | 错误会累积,难以调试 | 为每种语言完成完整周期 |
| "库的等效性足够接近" | 表面相似性隐藏了差异 | 验证 API 语义是否匹配 |
| "只需 1:1 翻译语法" | 语言有不同的惯用写法 | 研究目标语言的模式 |
此工作流程是严格的 - 不得跳过步骤:
此技能指导如何为现有 Semgrep 规则创建特定语言的变体。每个目标语言都经过一个独立的四阶段周期:
FOR EACH target language:
Phase 1: Applicability Analysis → Verdict
Phase 2: Test Creation (Test-First)
Phase 3: Rule Creation
Phase 4: Validation
(Complete full cycle before moving to next language)
semgrep-rule-creator 技能是关于 Semgrep 规则创建基础知识的权威参考。 虽然此技能侧重于将现有规则移植到新语言,但编写高质量规则的核心原则保持不变。
请参考 semgrep-rule-creator 以获取以下指导:
移植规则时,您是在新的语言环境中应用这些相同的原则。如果不确定规则结构或方法,请先参考 semgrep-rule-creator。
在移植之前,确定该模式是否适用于目标语言。
分析标准:
判定选项:
APPLICABLE → 继续创建变体APPLICABLE_WITH_ADAPTATION → 继续但需要重大更改NOT_APPLICABLE → 跳过此语言,记录原因详细指南请参阅 applicability-analysis.md。
始终先编写测试,再编写规则。
使用目标语言的惯用写法创建测试文件:
ruleid:)ok:)// ruleid: sql-injection-golang
db.Query("SELECT * FROM users WHERE id = " + userInput)
// ok: sql-injection-golang
db.Query("SELECT * FROM users WHERE id = ?", userInput)
semgrep --dump-ast -l <lang> test-file翻译指南请参阅 language-syntax-guide.md。
# Validate YAML
semgrep --validate --config rule.yaml
# Run tests
semgrep --test --config rule.yaml test-file
检查点:输出必须显示 All tests passed。
用于污点规则调试:
semgrep --dataflow-traces -f rule.yaml test-file
详细工作流程和故障排除请参阅 workflow.md。
| 任务 | 命令 |
|---|---|
| 运行测试 | semgrep --test --config rule.yaml test-file |
| 验证 YAML | semgrep --validate --config rule.yaml |
| 转储抽象语法树 | semgrep --dump-ast -l <lang> <file> |
| 调试污点流 | semgrep --dataflow-traces -f rule.yaml file |
| 方面 | semgrep-rule-creator | 此技能 |
|---|---|---|
| 输入 | 漏洞模式描述 | 现有规则 + 目标语言 |
| 输出 | 单个规则+测试 | 多个规则+测试目录 |
| 工作流程 | 单一创建周期 | 每种语言独立周期 |
| 阶段 1 | 问题分析 | 每种语言的适用性分析 |
| 库研究 | 始终相关 | 可选(当原始规则使用库时) |
必需:在移植规则之前,请阅读相关的 Semgrep 文档:
每周安装
1.1K
代码仓库
GitHub 星标
3.9K
首次出现
Jan 20, 2026
安全审计
安装于
claude-code947
opencode904
gemini-cli883
codex882
cursor859
github-copilot825
Port existing Semgrep rules to new target languages with proper applicability analysis and test-driven validation.
Ideal scenarios:
Do NOT use this skill for:
semgrep-rule-creator instead)This skill requires:
For each applicable target language, produces:
<original-rule-id>-<language>/
├── <original-rule-id>-<language>.yaml # Ported Semgrep rule
└── <original-rule-id>-<language>.<ext> # Test file with annotations
Example output for porting sql-injection to Go and Java:
sql-injection-golang/
├── sql-injection-golang.yaml
└── sql-injection-golang.go
sql-injection-java/
├── sql-injection-java.yaml
└── sql-injection-java.java
When porting Semgrep rules, reject these common shortcuts:
| Rationalization | Why It Fails | Correct Approach |
|---|---|---|
| "Pattern structure is identical" | Different ASTs across languages | Always dump AST for target language |
| "Same vulnerability, same detection" | Data flow differs between languages | Analyze target language idioms |
| "Rule doesn't need tests since original worked" | Language edge cases differ | Write NEW test cases for target |
| "Skip applicability - it obviously applies" | Some patterns are language-specific | Complete applicability analysis first |
| "I'll create all variants then test" | Errors compound, hard to debug | Complete full cycle per language |
| "Library equivalent is close enough" | Surface similarity hides differences | Verify API semantics match |
| "Just translate the syntax 1:1" | Languages have different idioms | Research target language patterns |
This workflow is strict - do not skip steps:
This skill guides the creation of language-specific variants of existing Semgrep rules. Each target language goes through an independent 4-phase cycle:
FOR EACH target language:
Phase 1: Applicability Analysis → Verdict
Phase 2: Test Creation (Test-First)
Phase 3: Rule Creation
Phase 4: Validation
(Complete full cycle before moving to next language)
Thesemgrep-rule-creator skill is the authoritative reference for Semgrep rule creation fundamentals. While this skill focuses on porting existing rules to new languages, the core principles of writing quality rules remain the same.
Consult semgrep-rule-creator for guidance on:
When porting a rule, you're applying these same principles in a new language context. If uncertain about rule structure or approach, refer to semgrep-rule-creator first.
Before porting, determine if the pattern applies to the target language.
Analysis criteria:
Verdict options:
APPLICABLE → Proceed with variant creationAPPLICABLE_WITH_ADAPTATION → Proceed but significant changes neededNOT_APPLICABLE → Skip this language, document whySee applicability-analysis.md for detailed guidance.
Always write tests before the rule.
Create test file with target language idioms:
Minimum 2 vulnerable cases (ruleid:)
Minimum 2 safe cases (ok:)
Include language-specific edge cases
// ruleid: sql-injection-golang db.Query("SELECT * FROM users WHERE id = " + userInput)
// ok: sql-injection-golang db.Query("SELECT * FROM users WHERE id = ?", userInput)
semgrep --dump-ast -l <lang> test-fileSee language-syntax-guide.md for translation guidance.
# Validate YAML
semgrep --validate --config rule.yaml
# Run tests
semgrep --test --config rule.yaml test-file
Checkpoint : Output MUST show All tests passed.
For taint rule debugging:
semgrep --dataflow-traces -f rule.yaml test-file
See workflow.md for detailed workflow and troubleshooting.
| Task | Command |
|---|---|
| Run tests | semgrep --test --config rule.yaml test-file |
| Validate YAML | semgrep --validate --config rule.yaml |
| Dump AST | semgrep --dump-ast -l <lang> <file> |
| Debug taint flow | semgrep --dataflow-traces -f rule.yaml file |
| Aspect | semgrep-rule-creator | This skill |
|---|---|---|
| Input | Bug pattern description | Existing rule + target languages |
| Output | Single rule+test | Multiple rule+test directories |
| Workflow | Single creation cycle | Independent cycle per language |
| Phase 1 | Problem analysis | Applicability analysis per language |
| Library research | Always relevant | Optional (when original uses libraries) |
REQUIRED : Before porting rules, read relevant Semgrep documentation:
Weekly Installs
1.1K
Repository
GitHub Stars
3.9K
First Seen
Jan 20, 2026
Security Audits
Gen Agent Trust HubFailSocketPassSnykPass
Installed on
claude-code947
opencode904
gemini-cli883
codex882
cursor859
github-copilot825
React 组合模式指南:Vercel 组件架构最佳实践,提升代码可维护性
102,200 周安装
NestJS专家服务 | 企业级TypeScript后端开发与架构设计
1,000 周安装
安全代码卫士:AI驱动的安全编码指南与最佳实践,防止SQL注入、XSS攻击
1,000 周安装
ESLint迁移到Oxlint完整指南:JavaScript/TypeScript项目性能优化工具
1,000 周安装
Chrome CDP 命令行工具:轻量级浏览器自动化,支持截图、执行JS、无障碍快照
1,000 周安装
Sanity内容建模最佳实践:结构化内容设计原则与无头CMS指南
1,000 周安装
AI Sprint规划器 - 敏捷团队Scrum迭代计划工具,自动估算故事点与容量管理
1,000 周安装