skills.rest
roderik
roderikCOMMUNITY
Explore all skills by this author →
Website𝕏@roderikGitHub

semgrep

Scan codebases with YAML rules to detect security vulnerabilities and quality issues.

2|Updated Jan 21, 2026
Search Tags:#security#CI/CD#static-analysis#semgrep#pattern-matching#taint
One-click install
npx skills add https://github.com/roderik/mpe --skill semgrep
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/roderik/mpe/tree/main/.agents/skills/semgrep
Command: npx skills add https://github.com/roderik/mpe --skill semgrep

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Semgrep provides fast, accessible static analysis to identify security vulnerabilities and coding issues directly in codebases, reducing manual review time.

Core Features & Use Cases

  • Quick Scan: Auto-detects or uses curated rule sets to find common vulnerability patterns.
  • Rulesets & Custom Rules: Write YAML-based rules to enforce standards and catch bugs specific to your codebase.
  • CI/CD Integration: Run semantic analysis in pipelines using SARIF/JSON outputs for automated checks.
  • Data-Flow (Taint) Analysis: Track data flow to identify potential insecure usage and injection points.
  • Use Case: Imagine scanning a Python project to locate hard-coded secrets and risky API usages.

Quick Start

Install Semgrep via pip, Homebrew, or Docker, then run a first scan with automatic configuration on your codebase. For example: semgrep --config auto .

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis to find security vulnerabilities in my codebase?▼

Run static analysis by installing via pip, brew, or Docker and executing a quick scan with automatic configuration. This applies fast, rules-based checks across multiple languages to identify security vulnerabilities and coding issues in your codebase.

How does taint analysis track data flow for injection points?▼

Taint analysis tracks data flow to identify potential insecure usage and injection points. It uses fast, configurable rules to monitor how untrusted data propagates through your code, catching risks that pattern-matching alone misses.

Can I integrate static code scanning into CI/CD pipelines?▼

Yes, you can integrate static code scanning into CI/CD pipelines. It supports automated checks using SARIF and JSON output formats, allowing pipelines to enforce security and quality rules continuously.

How do I write custom rules for security scanning?▼

Write custom rules for security scanning using YAML definitions. These rules allow you to enforce specific standards, catch bugs unique to your codebase, and perform pattern-matching against known vulnerability signatures.

Does static analysis work for small to large codebases across multiple languages?▼

Static analysis works for small to large codebases across multiple programming languages. It provides fast, accessible scanning and rule-based checks regardless of project scale, reducing manual review time.

Related Skills

Explore More Software Engineering Skills→
elizaOSelizaOS
19.0k

semgrep

Run fast static code analysis with Semgrep to detect security vulnerabilities.

Official
Intermediate
ofelixdevofelixdev

sarif-parsing

Parse SARIF files from static analysis tools and deduplicate findings.

Community
Intermediate
Fandhe-AIFandhe-AI
1

implement-review

Automate code review via git diff analysis for quality and security.

Official
Intermediate
roderikroderik
2

codeql

Identify security vulnerabilities in source code using CodeQL static analysis.

Community
Advanced