mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Lixin2026
d5fe2e6a78
* feat(codex): add skill UI metadata * Use official Trail of Bits logo * fix: resolve code review findings for PR #175 Codex silently drops the icons as authored: its loader (codex-rs/core-skills resolve_asset_path) requires icon paths containing '..' to resolve under <plugin_root>/assets/, and the repo-root .codex/assets location fails that containment check. Verified empirically via codex app-server plugin/read: every iconSmall/iconLarge came back null; only brand_color applied. P1 fixed: - Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for all 38 plugins with skills and point every openai.yaml at ../../assets/trail-of-bits-mark.svg (the supported plugin-level shared asset pattern). Icons now resolve for marketplace installs too, since nothing escapes the plugin root. - Drop the .codex/ additions: .codex/skills/gh-cli/agents/ openai.yaml resolved nowhere (.codex/skills is not a Codex discovery root) and PR #173 removes the whole .codex/ tree P2 fixed: - Patch-bump all 38 touched plugins in plugin.json and marketplace.json so installed clients pick up the metadata Verified: - Static check replicating Codex's resolution algorithm: all 73 yaml files resolve under their plugin assets/ and exist - Live codex app-server probe: 71/72 loadable skills report resolved iconSmall/iconLarge and brand_color #D83A34 (claude-in-chrome-troubleshooting fails to load on main due to a pre-existing 64-char qualified-name limit, fixed by #173's rename; zeroize-audit's manifest mcpServers object is likewise a pre-existing Codex incompatibility fixed by #173) - validate_codex_skills.py, validate_plugin_metadata.py, prek all pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(codex): use skill-local icon assets --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Semgrep Rule Variant Creator
A Claude Code skill for porting existing Semgrep rules to new target languages with proper applicability analysis and test-driven validation.
Overview
This skill takes an existing Semgrep rule and one or more target languages, then generates independent rule variants for each applicable language. Each variant goes through a complete 4-phase cycle:
- Applicability Analysis - Determine if the vulnerability pattern applies to the target language
- Test Creation - Write test-first with vulnerable and safe cases
- Rule Creation - Translate patterns and adapt for target language idioms
- Validation - Ensure all tests pass before proceeding
Prerequisites
- Semgrep installed and available in PATH
- Existing Semgrep rule to port (in YAML)
- Target languages specified
Usage
Invoke the skill when you want to port an existing Semgrep rule:
Port the sql-injection.yaml Semgrep rule to Go and Java
Create Semgrep rule variants of my-rule.yaml for TypeScript, Rust, and C#
Create the same Semgrep rule for JavaScript and Ruby
Port this Semgrep rule to Golang
Output Structure
For each applicable target language, the skill produces:
<original-rule-id>-<language>/
├── <original-rule-id>-<language>.yaml # Ported rule
└── <original-rule-id>-<language>.<ext> # Test file
Example
Input:
- Rule:
python-command-injection.yaml - Target languages: Go, Java
Output:
python-command-injection-golang/
├── python-command-injection-golang.yaml
└── python-command-injection-golang.go
python-command-injection-java/
├── python-command-injection-java.yaml
└── python-command-injection-java.java
Key Differences from semgrep-rule-creator
| Aspect | semgrep-rule-creator | semgrep-rule-variant-creator |
|---|---|---|
| Input | Bug pattern description | Existing rule + target languages |
| Output | Single rule+test | Multiple rule+test directories |
| Workflow | Single creation cycle | Independent cycle per language |
| Phase 1 | Problem analysis | Applicability analysis |
Skill Files
skills/semgrep-rule-variant-creator/SKILL.md- Main entry pointskills/semgrep-rule-variant-creator/references/applicability-analysis.md- Phase 1 guidanceskills/semgrep-rule-variant-creator/references/language-syntax-guide.md- Pattern translation guidanceskills/semgrep-rule-variant-creator/references/workflow.md- Detailed 4-phase workflow
Related Skills
- semgrep-rule-creator - Create new Semgrep rules from scratch
- static-analysis - Run existing Semgrep rules against code