semgrep

Name: semgrep
Availability: InStock
Author: ayehiaa

Run Semgrep static analysis scans and merge SARIF results.

Updated May 2, 2026

Search Tags:#static analysis #security audit #semgrep #sarif #code scanning #parallel orchestration

Ready to run

npx skills add https://github.com/ayehiaa/my-travel-assistant --skill semgrep-ayehiaa

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/ayehiaa/my-travel-assistant/tree/main/.agents/skills/semgrep
Command: npx skills add https://github.com/ayehiaa/my-travel-assistant --skill semgrep-ayehiaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps you detect security vulnerabilities in a codebase by orchestrating a complete Semgrep scan workflow, producing merged SARIF output for review.

Core Features & Use Cases

Parallel, language-aware scanning: Automatically detects languages in the target and runs per-language scans concurrently.
Ruleset plan with a hard approval gate: Presents the exact rulesets and scan mode to the user and waits for explicit proceed/yes before running.
Merged SARIF results: Consolidates per-scan SARIF into a single deduplicated results.sarif, supporting both OSS and Pro modes.
Optional “important only” filtering: Limits findings to security-relevant issues using severity flags and metadata post-filtering.

Quick Start

Ask an AI agent to run a Semgrep security audit on /path/to/codebase in important-only mode and save results to ./static_analysis_semgrep_1.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a static analysis security audit on a multi-language codebase?▼

To run a static analysis security audit, you can use Semgrep to automatically detect languages in your repository and execute per-language scans concurrently. This workflow identifies vulnerabilities and risky patterns across the codebase.

How do I merge multiple SARIF code scanning results into a single file?▼

Merging SARIF code scanning results involves consolidating per-scan outputs into a single deduplicated file. This process creates a unified results.sarif file to support downstream triage and vulnerability review.

Can I filter static analysis findings to show only high severity security vulnerabilities?▼

Yes, you can filter static analysis findings to show only security vulnerabilities by using an important-only mode. This limits results to security-relevant issues using severity flags and metadata post-filtering.

Does Semgrep code scanning require an approval step before executing rulesets?▼

Semgrep code scanning can enforce an approval-gated ruleset plan. It presents the exact rulesets and scan mode to the user and waits for explicit proceed or yes confirmation before running any scans.

How do I run Semgrep scans with metrics disabled for privacy?▼

To run Semgrep scans with metrics disabled for privacy, the static analysis process must enforce the --metrics=off flag. This ensures code scanning execution does not transmit usage telemetry.