skills.rest
ayehiaa
ayehiaaCOMMUNITY
Explore all skills by this author →
GitHub

semgrep

Run Semgrep static analysis scans and merge SARIF results.

Updated May 2, 2026
Search Tags:#static analysis#security audit#semgrep#sarif#code scanning#parallel orchestration
One-click install
npx skills add https://github.com/ayehiaa/my-travel-assistant --skill semgrep-ayehiaa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/ayehiaa/my-travel-assistant/tree/main/.agents/skills/semgrep
Command: npx skills add https://github.com/ayehiaa/my-travel-assistant --skill semgrep-ayehiaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps you detect security vulnerabilities in a codebase by orchestrating a complete Semgrep scan workflow, producing merged SARIF output for review.

Core Features & Use Cases

  • Parallel, language-aware scanning: Automatically detects languages in the target and runs per-language scans concurrently.
  • Ruleset plan with a hard approval gate: Presents the exact rulesets and scan mode to the user and waits for explicit proceed/yes before running.
  • Merged SARIF results: Consolidates per-scan SARIF into a single deduplicated results.sarif, supporting both OSS and Pro modes.
  • Optional “important only” filtering: Limits findings to security-relevant issues using severity flags and metadata post-filtering.

Quick Start

Ask an AI agent to run a Semgrep security audit on /path/to/codebase in important-only mode and save results to ./static_analysis_semgrep_1.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a static analysis security audit on a multi-language codebase?▼

To run a static analysis security audit, you can use Semgrep to automatically detect languages in your repository and execute per-language scans concurrently. This workflow identifies vulnerabilities and risky patterns across the codebase.

How do I merge multiple SARIF code scanning results into a single file?▼

Merging SARIF code scanning results involves consolidating per-scan outputs into a single deduplicated file. This process creates a unified results.sarif file to support downstream triage and vulnerability review.

Can I filter static analysis findings to show only high severity security vulnerabilities?▼

Yes, you can filter static analysis findings to show only security vulnerabilities by using an important-only mode. This limits results to security-relevant issues using severity flags and metadata post-filtering.

Does Semgrep code scanning require an approval step before executing rulesets?▼

Semgrep code scanning can enforce an approval-gated ruleset plan. It presents the exact rulesets and scan mode to the user and waits for explicit proceed or yes confirmation before running any scans.

How do I run Semgrep scans with metrics disabled for privacy?▼

To run Semgrep scans with metrics disabled for privacy, the static analysis process must enforce the --metrics=off flag. This ensures code scanning execution does not transmit usage telemetry.

Related Skills

Explore More Software Engineering Skills→
Ramprasad4121Ramprasad4121
1

semgrep

Run Semgrep static analysis to detect vulnerabilities and bugs across codebases.

Community
Advanced
igbuendigbuend
8

trivy

Execute Aqua Trivy security scans for vulnerabilities, secrets, and misconfigurations.

Community
Advanced
hardw00thardw00t
90

sast-orchestration

Orchestrate Semgrep, CodeQL, and Bandit scans across codebases.

Community
Advanced
h4vzzh4vzz
33

static-application-security-testing

Scan source code for security vulnerabilities and generate SARIF reports.

Community
Advanced