Run Semgrep security scans with language detection and merged SARIF output.
npx skills add https://github.com/adamatdevops/forge-works --skill semgrep-adamatdevops
Please help me install this Agent Skill. Skill: semgrep Source: https://github.com/adamatdevops/forge-works/tree/main/.skills/trailofbits/semgrep Command: npx skills add https://github.com/adamatdevops/forge-works --skill semgrep-adamatdevops
It helps you run comprehensive Semgrep security scans on a codebase and produce a consolidated SARIF report for review and triage.
Ask: “Run the semgrep skill on /path/to/codebase in run-all mode and write results to ./my_scan_output; include Pro if available.”
High-intent search queries and answers about installing and using this skill.
Semgrep static analysis runs automatically by detecting codebase languages, scanning concurrently per language category, and merging per-scan SARIF outputs into a single consolidated results.sarif report using SARIF Multitool or a pure-Python fallback.
Yes, you can apply custom rulesets when scanning code for security findings. The skill generates an approved ruleset plan including required third-party rulesets, but blocks execution behind an explicit hard approval gate before any scanning begins.
Semgrep security scanning supports run-all and important-only scanning modes. You specify the desired mode during the ruleset planning phase, and the skill applies it across all detected languages during parallel worker execution.
To ensure deterministic output for SARIF security scans, the skill enforces --metrics=off on every Semgrep invocation and writes results to an incrementing or user-specified OUTPUT_DIR, guaranteeing consistent and reproducible reporting across runs.
When merging multiple SARIF files, a limitation occurs if SARIF Multitool is unavailable, triggering a pure-Python merge fallback. The skill handles this automatically to consolidate per-language security scan outputs into a single report.
ayehiaaRun Semgrep static analysis scans and merge SARIF results.
SuperlendParse SARIF 2.1.0 files and extract structured findings for reporting.
dakshrawat298-gifParse and unify static-analysis tool outputs to identify vulnerabilities across codebases.
leonardoteodorooConfigure Semgrep, SonarQube, and CodeQL for CI/CD security scanning.
