skills.rest
waybarrios
waybarriosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

semgrep

Run Semgrep static analysis scans across codebases and merge findings into SARIF reports.

507|40|Updated Apr 26, 2026
Search Tags:#static analysis#security scan#code audit#sast#vulnerability detection#semgrep#sarif
One-click install
npx skills add https://github.com/waybarrios/opencode-power-pack --skill semgrep-waybarrios
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/waybarrios/opencode-power-pack/tree/main/skills/semgrep
Command: npx skills add https://github.com/waybarrios/opencode-power-pack --skill semgrep-waybarrios

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Running a thorough static security analysis requires choosing the right rulesets, configuring Semgrep correctly, avoiding telemetry leakage, and consolidating scattered scan output. This Skill orchestrates the entire Semgrep scanning workflow so findings are complete, deduplicated, and merged into a single SARIF report. ## Core Features & Use Cases - Guided 5-Step Scan Workflow: Detects languages and frameworks, selects official and third-party rulesets (Trail of Bits, 0xdea, Decurity), requires explicit user approval of the scan plan, runs per-language scans in parallel, and merges results. - Semgrep Pro Detection: Checks for Pro availability to enable cross-file taint analysis, which catches significantly more true positives than OSS-only scanning. - Two Scan Modes: Run-all for full coverage, or important-only mode that pre-filters by severity and post-filters by security category, confidence, and impact metadata. - SARIF Merging: A bundled Python script merges per-scan SARIF files into one deduplicated results.sarif, using SARIF Multitool when available with a pure-Python fallback. - Use Case: Point it at a polyglot repository (Python, JavaScript, Docker) before a release; it detects the languages, proposes rulesets including third-party security rules, and produces a merged SARIF report with severity and category breakdowns. ## Quick Start Ask the agent to run a Semgrep security scan on your project directory and approve the proposed ruleset plan when prompted.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Semgrep security scan on my codebase?▼

Invoke the skill with a target directory; it detects languages and frameworks, proposes official and third-party rulesets, and waits for your explicit approval before scanning. Results are merged into a single results.sarif file in the output directory.

What is the difference between Semgrep OSS and Semgrep Pro scanning?▼

Semgrep OSS analyzes files individually, while Semgrep Pro enables cross-file taint tracking and inter-procedural analysis, catching roughly 250% more true positives. The skill automatically checks Pro availability and uses it when present.

Does Semgrep send telemetry during scans?▼

Semgrep sends telemetry by default, and --config auto also phones home. This skill adds --metrics=off to every semgrep command to prevent data leakage during security audits.

How do I filter Semgrep results to only important security findings?▼

Use important-only mode, which pre-filters with --severity MEDIUM/HIGH/CRITICAL flags and post-filters JSON results by category=security with medium-high confidence and impact metadata. Raw unfiltered results are preserved alongside filtered output.

When should I not use Semgrep for static analysis?▼

Avoid it for binary analysis, when a Semgrep CI pipeline already exists, or when you need cross-file analysis without a Pro license (consider CodeQL instead). For writing custom rules, use a dedicated rule-creation skill.

How do I merge multiple Semgrep SARIF files into one report?▼

Run the bundled merge_sarif.py script with the raw output directory and target file path. It uses SARIF Multitool via npx when available, otherwise falls back to a pure-Python merge that deduplicates findings by rule, file, and line.

Related Skills

Explore More Software Engineering Skills→
TimMoyenceTimMoyence

semgrep

Run parallel Semgrep scans across multi-language repositories and merge SARIF results.

Community
Advanced
CarbonTailsCarbonTails

triage

Automates the categorization of issues and pull requests and generates agent briefs.

Official
Intermediate
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced
AgentSystemLabsAgentSystemLabs
121

check-pr-readiness

Run diff-scoped typechecking, linting, formatting, and tests on pull requests.

Official
Advanced