skills.rest
idchain-world
idchain-worldOFFICIAL
Explore all skills by this author →
WebsiteGitHub

semgrep

Coordinates parallel Semgrep scans across detected languages and merges results into SARIF output files.

16|4|Updated Mar 22, 2026
Search Tags:#security#parallel#static-analysis#semgrep#code-scan#sarif
One-click install
npx skills add https://github.com/idchain-world/id-agents --skill semgrep-idchain-world
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/idchain-world/id-agents/tree/main/configs/agents/security/skills/static-analysis/semgrep
Command: npx skills add https://github.com/idchain-world/id-agents --skill semgrep-idchain-world

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill coordinates fast, scalable static analysis by running Semgrep scans in parallel across language-specific subagents, reducing time to find vulnerabilities in large codebases.

Core Features & Use Cases

  • Detects languages and detects Pro availability to enable cross-file taint tracking when possible.
  • Spawns parallel scanner subagents for Python, JavaScript/TypeScript, Go, Java, Docker, and more, merging results into a single SARIF file.
  • Ideal for security audits, pre-commit checks, and continuous security testing across multi-repo projects.

Quick Start

Run a multi-language Semgrep scan by initiating Step 1 to detect languages, Step 2 to choose a mode and rulesets, and Step 3 to approve the plan, then Step 4 to spawn scanners and Step 5 to merge results.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run parallel static analysis scans across a multi-language codebase?▼

Parallel static analysis scans run by detecting languages in a codebase and spawning parallel subagents for Python, JavaScript/TypeScript, Go, Java, and Docker, merging results into a single SARIF output directory.

How does parallel Semgrep scanning handle cross-file taint tracking?▼

Cross-file taint tracking is handled by detecting Semgrep Pro availability and automatically enabling Pro features during the parallel scan execution to trace data flow across multiple files.

Can I merge multiple static analysis scan results into a single SARIF file?▼

Yes, you can merge multiple static analysis scan results into a single SARIF file. The skill coordinates parallel subagent execution and merges all individual SARIF results into a single output directory.

What is the best way to automate security audits for large multi-repo projects?▼

Automating security audits for large multi-repo projects is best achieved by coordinating parallel Semgrep scans across language-aware rulesets, reducing the time to find vulnerabilities in large codebases.

Does parallel Semgrep scanning require explicit plan approval before execution?▼

Yes, parallel Semgrep scanning requires explicit plan approval; the workflow mandates language detection, mode selection, and plan approval before spawning parallel subagents and merging SARIF results.

What static analysis modes are available for code scanning?▼

Available static analysis modes for code scanning include running all rulesets or running important rulesets only, selectable after automatic language detection and before parallel subagent execution.

Related Skills

Explore More Software Engineering Skills→
ayehiaaayehiaa

semgrep

Run Semgrep static analysis scans and merge SARIF results.

Community
Advanced
igbuendigbuend
8

sarif-issue-reporter

Analyze SARIF 2.1.0 files to generate vulnerability reports with CVSS scoring.

Community
Advanced
iiammaeiiammae

sarif-parsing

Parse SARIF files with filtering, deduplication, and format conversion.

Community
Intermediate
Ramprasad4121Ramprasad4121
1

semgrep

Run Semgrep static analysis to detect vulnerabilities and bugs across codebases.

Community
Advanced