skills.rest
curtismu7
curtismu7COMMUNITY
Explore all skills by this author →
GitHub

semgrep

Runs Semgrep static analysis scans with parallel subagents and merged SARIF output.

1|Updated Jun 25, 2026
Search Tags:#static analysis#security scan#code audit#sast#vulnerability detection#semgrep#sarif
One-click install
npx skills add https://github.com/curtismu7/AI-DEMO2 --skill semgrep-curtismu7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/curtismu7/AI-DEMO2/tree/main/security/semgrep
Command: npx skills add https://github.com/curtismu7/AI-DEMO2 --skill semgrep-curtismu7

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Running comprehensive Semgrep security scans across multi-language codebases is slow and error-prone when done manually: rulesets must be selected per language, third-party rules are easy to miss, and results arrive in fragmented files. This Skill orchestrates the entire audit — language detection, ruleset selection, user-approved scan planning, parallel execution, and SARIF merging — so you get consolidated, deduplicated findings without manual coordination. ## Core Features & Use Cases - Parallel multi-language scanning: Detects languages and frameworks automatically, then spawns one scanner subagent per language category running rulesets concurrently. - Two scan modes: "Run all" for full coverage, or "Important only" which pre-filters by severity and post-filters by security category, confidence, and impact metadata. - Semgrep Pro detection: Automatically checks for Pro availability to enable cross-file taint analysis, and always disables telemetry with --metrics=off. - Mandatory approval gate: Presents the exact ruleset list (including required third-party rules from Trail of Bits, 0xdea, and Decurity) and waits for explicit user approval before scanning. - Use Case: Point it at a polyglot repository (Python/Django backend, React frontend, Dockerfiles) before a release; it detects the stack, proposes rulesets, runs all scans in parallel, and delivers a single merged results.sarif with a severity breakdown. ## Quick Start Ask the agent to run a Semgrep security scan on your codebase and approve the scan plan it presents.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Semgrep security scan on a multi-language codebase?▼

Invoke the skill with a target directory; it detects languages and frameworks, selects matching rulesets plus required third-party rules, and presents a plan for approval. After you approve, it spawns parallel scanner subagents per language and merges all results into one SARIF file.

What is the difference between run-all and important-only Semgrep scan modes?▼

Run-all reports every finding from all rulesets at all severity levels. Important-only pre-filters with MEDIUM/HIGH/CRITICAL severity flags and post-filters JSON results to keep only security-category findings with medium-high confidence and impact.

Does Semgrep support cross-file taint analysis?▼

Cross-file taint tracking requires Semgrep Pro; the OSS engine only analyzes within single files. The skill automatically checks Pro availability with a validation command and uses the --pro flag when available, which catches substantially more inter-file vulnerabilities.

Why must I approve the scan plan before Semgrep runs?▼

The approval gate is a hard checkpoint ensuring you see the exact target, engine, scan mode, and full ruleset list before execution. The original scan request does not count as approval; you can modify rulesets before confirming.

When should I not use Semgrep for static analysis?▼

Avoid it for binary analysis, when a Semgrep CI pipeline already exists, or when you need cross-file analysis without a Pro license — consider CodeQL instead. For writing custom rules, use a dedicated rule-creation skill rather than this scanner.

How are Semgrep scan results merged into one report?▼

A Python script merges all SARIF files from the raw output directory, preferring Microsoft's SARIF Multitool via npx when available and falling back to a pure-Python merger. It deduplicates findings by rule ID, file URI, and line number, then writes a single results.sarif.

Related Skills

Explore More Software Engineering Skills→
TimMoyenceTimMoyence

semgrep

Run parallel Semgrep scans across multi-language repositories and merge SARIF results.

Community
Advanced
igbuendigbuend
8

sarif-issue-reporter

Analyze SARIF 2.1.0 files to generate vulnerability reports with CVSS scoring.

Community
Advanced
Helcio-NogueiraHelcio-Nogueira

vulnerability-scanner

Scan projects for OWASP 2025 vulnerabilities, secrets, and supply chain risks.

Community
Advanced
heyu-aiheyu-ai

ci-triage

Diagnose CI pipeline failures in Python, JavaScript, and Go stacks.

Official
Intermediate