skills.rest
fjor1025
fjor1025COMMUNITY
Explore all skills by this author →
GitHub

semgrep

Scan codebases for security vulnerabilities and enforce coding standards with Semgrep.

Updated Feb 13, 2026
Search Tags:#code quality#static analysis#security scanning#vulnerability detection#semgrep#taint analysis
One-click install
npx skills add https://github.com/fjor1025/InfoSec-Framework --skill semgrep-fjor1025
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/fjor1025/InfoSec-Framework/tree/main/ClaudeSkills/plugins/static-analysis/skills/semgrep
Command: npx skills add https://github.com/fjor1025/InfoSec-Framework --skill semgrep-fjor1025

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the process of scanning codebases for security vulnerabilities and code quality issues using static analysis.

Core Features & Use Cases

  • Fast Security Scanning: Quickly identify known vulnerability patterns and enforce coding standards.
  • Custom Rule Creation: Write and apply your own YAML rules for specific project needs.
  • Taint Analysis: Track data flow from sources to sinks to detect potential security risks like injection vulnerabilities.
  • Use Case: You need to quickly check a Python codebase for common security flaws before merging a pull request.

Quick Start

Use the semgrep skill to scan the current directory for security vulnerabilities using the default ruleset.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan code for security vulnerabilities using static analysis?▼

Taint mode analysis tracks data flow from sources to sinks to detect potential security risks. It identifies untrusted inputs and traces their propagation through the codebase to sinks, preventing injection vulnerabilities before deployment.

How do I write custom YAML rules for project-specific security scanning?▼

Custom YAML rules allow you to define specific vulnerability patterns and coding standards for your project. Writing and applying these rules tailors static analysis to unique security requirements across various programming languages.

Do I need to install Semgrep before running static code analysis?▼

Yes, Semgrep installation is required before running static code analysis to identify vulnerabilities. The environment must have the tool installed to execute rapid security scanning and taint mode analysis across your codebase.

Can I integrate static analysis security scanning into a CI/CD workflow?▼

Static analysis security scanning supports CI/CD integration to automate vulnerability detection during software development. Integrating this process into CI/CD pipelines enforces coding standards and blocks vulnerable code from merging.

Related Skills

Explore More Software Engineering Skills→
roderikroderik
2

semgrep

Scan codebases with YAML rules to detect security vulnerabilities and quality issues.

Community
Advanced
thesammykinsthesammykins

code-quality-gates

Enforces predefined quality gates for code reviews and merges.

Community
Advanced
Serg28Serg28

security-reviewer

Automate security audits with semgrep, trivy, gitleaks, and dependency scanners.

Community
Intermediate
adminsairolotech-bitadminsairolotech-bit

security_scan

Orchestrate dependency audits, SAST, and dataflow analysis into prioritized vulnerability summaries.

Community
Advanced