semgrep-rule-variant-creator

An agent skill by trailofbits, from trailofbits/skills. Tags: code-quality, developer-tools, migration, semgrep.

What it does

Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill semgrep-rule-variant-creator

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/semgrep-rule-variant-creator/skills/semgrep-rule-variant-creator ~/.claude/skills/semgrep-rule-variant-creator

Safety box score

Grade B, low risk: 21 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill ports Semgrep rules into per-language variants and drives a workflow that reads the rule, writes test/rule files, and validates them with Semgrep. The main risks are bounded file access outside the project to locate references/workflow state, and the fact that it can produce apparently green variants from self-written tests rather than an independent oracle.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs a workflow script and Semgrep commands, including `Workflow({scriptPath: ...})`, `/semgrep-rule-variant-creator:port-rule-to-languages`, and `semgrep --test`.
Network access	1 (low)	The skill includes `WebFetch` in its allowed tools and links to external docs like `https://semgrep.dev/docs/...`, so it may fetch reference material from the network.
Filesystem reach	2 (moderate)	It reads outside the project to find references and workflow state via `find ~/.claude ~/.codex ...` and `ls -d ~/.claude/projects///subagents/workflows/*/`.
Secrets & credentials	0 (none)	There is no instruction to read tokens, keys, passwords, `.env` files, browser sessions, or other credential stores.
Privilege & persistence	0 (none)	No sudo, global install, service registration, shell-startup edits, or other privilege-changing action is requested.
Instruction hijack surface	0 (none)	The text is workflow guidance rather than hostile prompt injection; it does not ask the agent to ignore higher-priority instructions or hide behavior.
Irreversible actions	1 (low)	The workflow autonomously creates per-language output directories and can resume/re-run phases, but it does not publish, message, deploy, or pay.
Transparency	0 (none)	All shipped files are plain text (Markdown, YAML, SVG); there are no binaries, minified blobs, or downloaded installers.

Before installing

Read `SKILL.md` and `references/workflow.md` to confirm you are okay with the home-directory scans for `~/.claude` / `~/.codex`.
Run the workflow in a scratch repo first, because it writes generated rule/test directories and may resume/re-run phases.
Check `workflows/port-rule-to-languages.js` exists in the plugin root and is the version you expect before trusting any green test run.
Verify the target `outputDir` is not your main working tree if you want to avoid generated files landing in the current directory.

Rated 2026-10-20 by an automated review of 6 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/semgrep-rule-variant-creator/skills/semgrep-rule-variant-creator/SKILL.md
Branch: main
Collection: semgrep-rule-variant-creator
Updated: 2026-09-19

semgrep-rule-creator — Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.
harness-writing — Designs and improves fuzzing harnesses for C/C++ and Rust.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.