skills.rest
Ayoub-ouederni
Ayoub-ouederniCOMMUNITY
Explore all skills by this author →
GitHub

semgrep

Run parallel Semgrep static analysis scans and merge findings into SARIF reports.

Updated Apr 3, 2026
Search Tags:#static analysis#security scan#code audit#sast#vulnerability detection#semgrep#sarif
One-click install
npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill semgrep-ayoub-ouederni
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/Ayoub-ouederni/SENTINEL/tree/main/.claude/skills/semgrep
Command: npx skills add https://github.com/Ayoub-ouederni/SENTINEL --skill semgrep-ayoub-ouederni

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Running comprehensive Semgrep security scans across multi-language codebases is slow and error-prone when done sequentially, and results from multiple rulesets end up scattered across separate files. This Skill orchestrates parallel scans with automatic language detection, curated ruleset selection, and merged SARIF output. ## Core Features & Use Cases - Parallel Multi-Language Scanning: Detects languages and frameworks automatically, then spawns concurrent scanner subagents for Python, JavaScript/TypeScript, Go, Docker, and more. - Two Scan Modes: Choose "run all" for full coverage or "important only" for high-confidence security vulnerabilities filtered by severity, confidence, and impact metadata. - Semgrep Pro Detection: Automatically checks for Semgrep Pro to enable cross-file taint analysis, and includes third-party rulesets from Trail of Bits, 0xdea, and Decurity. - Use Case: Before a release, ask for a security audit of your repository; the Skill presents a ruleset plan for approval, runs all scans in parallel, and delivers a single merged results.sarif with a severity breakdown. ## Quick Start Ask the assistant to run a Semgrep security scan on your codebase and approve the proposed scan plan when prompted.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Semgrep security scan on my codebase?▼

Invoke the skill with a scan request, and it detects languages, proposes rulesets, and waits for your explicit approval before scanning. Parallel scanner subagents then execute the approved rulesets and merge results into a single SARIF file.

What is the difference between run-all and important-only Semgrep scan modes?▼

Run-all reports every finding from all rulesets at all severity levels. Important-only pre-filters with MEDIUM/HIGH/CRITICAL severity flags and post-filters JSON metadata to keep only security findings with medium-high confidence and impact.

Does Semgrep support cross-file taint analysis?▼

Cross-file taint tracking requires Semgrep Pro, which the skill detects automatically before scanning. Without a Pro license, analysis is limited to single-file data flow, and the skill suggests CodeQL as an alternative.

Why should third-party Semgrep rulesets be included in scans?▼

Third-party rulesets from Trail of Bits, 0xdea, and Decurity catch vulnerabilities absent from the official Semgrep registry, including smart contract and memory-safety issues. The skill treats them as required whenever the detected language matches.

When should I not use Semgrep for static analysis?▼

Avoid it for binary analysis, when a Semgrep CI pipeline already exists, or when you need cross-file analysis without a Pro license. For creating or porting custom rules, dedicated rule-authoring skills are more appropriate.

Related Skills

Explore More Software Engineering Skills→
usadamasausadamasa

ghq-lookup

Prioritize local ghq clones for repository URLs before remote fetching.

Community
Intermediate
joshftjoshft
65

caudit

Audit codebases for systemic quality issues with structured convergence workflows.

Community
Advanced
ntuan2502ntuan2502

vulnerability-scanner

Scan project dependencies, code patterns, secrets, and configurations for vulnerabilities.

Community
Advanced
fjor1025fjor1025

codeql

Perform static code analysis with CodeQL for security vulnerabilities and data flow.

Community
Advanced