skills.rest
marcboggs
marcboggsCOMMUNITY
Explore all skills by this author →
GitHub

sast-semgrep-hunting

Scan source code with Semgrep to detect injection sinks, secrets, and taint flows.

1|Updated Aug 21, 2026
Search Tags:#static analysis#security testing#code audit#sast#vulnerability scanning#semgrep#taint analysis
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill sast-semgrep-hunting-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-semgrep-hunting
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/sast-semgrep-hunting
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill sast-semgrep-hunting-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Black-box testing alone misses vulnerabilities hidden in internal routes, cron jobs, and message handlers. This Skill performs white-box static analysis with Semgrep MCP to locate vulnerable code patterns, then guides dynamic validation so findings become reportable, evidence-backed vulnerabilities. ## Core Features & Use Cases - Broad and Class-Specific Scanning: Run configs like p/security-audit, p/sql-injection, p/xss, p/ssrf, p/secrets, and p/jwt to sweep codebases for OWASP Top 10 patterns across supported languages. - Custom Rule Authoring: Write YAML rules for app-specific patterns such as missing auth decorators, f-string SQL injection, and open redirects. - Taint and AST Analysis: Use get_abstract_syntax_tree to trace user input to dangerous sinks across files, decorators, and middleware chains. - Use Case: After decompiling an APK with jadx, scan the Java source with Semgrep to find hardcoded API keys and exported components, then validate each finding with a real HTTP request before reporting. ## Quick Start Scan this repository with Semgrep for SQL injection and hardcoded secrets, then list the reachable sinks I should validate dynamically.

Frequently Asked Questions about sast-semgrep-hunting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find SQL injection vulnerabilities in source code with Semgrep?▼

Run semgrep_scan with the p/sql-injection config to flag queries built from user input, or write a custom rule matching f-string interpolation into cursor.execute. Confirm each finding by sending an injection payload to the reachable endpoint.

How do I write custom Semgrep rules for app-specific patterns?▼

Define a YAML rule with an id, pattern, message, languages, and severity, then run semgrep_scan_with_custom_rule. Use pattern-not clauses to exclude safe variants, such as routes protected by a login_required decorator.

Can Semgrep findings be reported as vulnerabilities directly?▼

No. SAST findings alone are not reportable because they may be dead code or sanitized. Each finding must be reachable, exploitable, and validated with a real HTTP request demonstrating impact before reporting.

Does Semgrep support scanning decompiled Android APK code?▼

Yes. After decompiling an APK with jadx, scan the resulting Java or Kotlin source with Semgrep to find hardcoded secrets, insecure cryptography, and exported components. Verify language coverage with the supported_languages tool.

When should I use AST analysis instead of pattern matching?▼

Use get_abstract_syntax_tree when taint flows cross multiple files or functions, when custom sanitization logic must be understood, or when mapping decorator and middleware chains that apply authentication.

Related Skills

Explore More Software Engineering Skills→
philo-grovesphilo-groves
12

maxtac-re-jadx

Reverse engineer Android APKs and DEX files with Jadx.

Community
Advanced
jd-opensourcejd-opensource
299

pentest-exploit-validation

Validate security findings through proof-driven exploitation with a four-level evidence system.

Official
Advanced
chengzongcaichengzongcai
21

src-hunter

Guides authorized bug bounty hunting through a five-phase recon-to-report workflow.

Community
Advanced
Q16GQ16G
83

graybox-p0

Orchestrate gray-box testing by combining white-box candidate discovery with black-box request validation.

Community
Intermediate