skills.rest
stefaniuk
stefaniukCOMMUNITY
Explore all skills by this author →
GitHub

semgrep

Runs Semgrep security scans with language detection, parallel ruleset execution, and merged SARIF output.

1|Updated Jan 4, 2026
Search Tags:#static analysis#security scan#code audit#sast#vulnerability detection#semgrep#sarif
One-click install
npx skills add https://github.com/stefaniuk/loadout --skill semgrep-stefaniuk
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/stefaniuk/loadout/tree/main/.github/skills/semgrep
Command: npx skills add https://github.com/stefaniuk/loadout --skill semgrep-stefaniuk

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Running a thorough Semgrep security audit by hand means detecting languages, picking the right registry and third-party rulesets, keeping telemetry off, running scans in parallel, and merging dozens of SARIF files — a process that is easy to get wrong and hard to trust. This Skill automates that entire workflow while keeping the user in control through an explicit approval gate before any scan runs. ## Core Features & Use Cases - Automatic language and framework detection: Globs the target tree for source files and reads manifests like package.json and pyproject.toml to select matching registry and third-party rulesets (Trail of Bits, 0xdea, Decurity). - Two scan modes: "Run all" for full coverage, or "Important only" which pre-filters by severity and post-filters JSON metadata to keep only medium-to-high confidence and impact security findings. - Deterministic parallel execution: scripts/run-scans.sh generates every semgrep command with --metrics=off, runs them in batches, and records successes, failures, and skipped rulesets in scans.json. - Merged SARIF reporting: scripts/merge_sarif.py deduplicates findings across rulesets, excludes failed scans, and produces a single results.sarif. - Use Case: Point it at a polyglot repository before a release; it detects Python, JavaScript, and Docker, proposes a ruleset plan, and after your approval produces one merged SARIF file with a severity and category breakdown. ## Quick Start Ask the assistant to run a Semgrep security scan on your codebase and approve the ruleset plan it presents.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Semgrep security scan on my codebase?▼

Invoke the skill with a target directory; it detects languages and frameworks, selects registry and third-party rulesets, presents the plan for your explicit approval, then runs all scans in parallel and merges results into one SARIF file.

What is the difference between run-all and important-only Semgrep scan modes?▼

Run-all reports every finding from all rulesets at all severity levels. Important-only pre-filters with --severity WARNING and ERROR, then post-filters JSON metadata to keep only security findings with medium-to-high confidence and impact.

Does Semgrep support cross-file taint analysis?▼

Cross-file taint tracking requires Semgrep Pro, which the skill checks for before scanning with semgrep --pro --validate. Without a Pro license, scans run in OSS mode limited to single-file analysis, and CodeQL is suggested as an alternative.

Why does the skill require third-party Semgrep rulesets?▼

Trail of Bits, 0xdea, and Decurity rules catch vulnerabilities absent from the official Semgrep registry, such as memory-safety issues in C/C++ and smart contract exploits. They are cloned and included automatically whenever the detected languages match.

When should I not use Semgrep for static analysis?▼

Avoid it for binary analysis, when a Semgrep CI pipeline already exists, or when you need cross-file analysis without a Pro license. For writing custom rules, use the semgrep-rule-creator skill instead.

Why does a Semgrep scan report zero findings for a ruleset?▼

A ruleset whose --include globs match no files exits 0 with an empty result, indistinguishable from a clean scan. The runner records these under coveredNothing in scans.json so the report can distinguish no coverage from no findings.

Related Skills

Explore More Software Engineering Skills→
TimMoyenceTimMoyence

semgrep

Run parallel Semgrep scans across multi-language repositories and merge SARIF results.

Community
Advanced
elizaOSelizaOS
19.0k

sarif-parsing

Parse and analyze SARIF 2.1.0 files for security scan results.

Official
Intermediate
ag47-ptag47-pt
1

vulnerability-scanner

Identify and prioritize software vulnerabilities across code, dependencies, and configurations.

Community
Advanced
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate