skills.rest
jakubciszak
jakubciszakCOMMUNITY
Explore all skills by this author →
GitHub

semgrep

Apply Semgrep rules to identify security issues across multi-language codebases.

1|Updated Dec 10, 2025
Search Tags:#security#static-analysis#ci-cd#rules#semgrep#pattern-matching#taint
One-click install
npx skills add https://github.com/jakubciszak/family-plan --skill semgrep-jakubciszak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/jakubciszak/family-plan/tree/main/.claude/skills/external/static-analysis/skills/semgrep
Command: npx skills add https://github.com/jakubciszak/family-plan --skill semgrep-jakubciszak

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Semgrep helps teams quickly detect security and quality issues in codebases by applying fast, pattern-based analysis and customizable rules.

Core Features & Use Cases

  • Pattern-based scanning: Apply customizable rules to multiple languages to identify common vulnerabilities and code quality issues.
  • Taint-mode data flow: Track untrusted data through code paths to surface potential security risks.
  • CI/CD integration: Run Semgrep in pipelines to enforce rules during build and deployment.

Quick Start

Run a quick scan on your repository using Semgrep rules to surface vulnerabilities and style issues.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis to detect security vulnerabilities in a multi-language codebase?▼

Run static analysis by applying customizable Semgrep rules to your multi-language codebase to identify common vulnerabilities. This pattern-based scanning quickly surfaces security and code quality issues across languages like Python and JavaScript.

What is taint-mode data flow tracking and when do I need it for code security?▼

Taint-mode data flow tracking traces untrusted data through code paths to surface potential security risks. You need it when pattern-based scanning is insufficient to detect complex injection vulnerabilities requiring data origin analysis.

Can I integrate static analysis scans into my CI/CD pipelines?▼

Yes, you can integrate static analysis scans into CI/CD pipelines to enforce rules during build and deployment. Running Semgrep in pipelines automates vulnerability detection and prevents insecure code from reaching production.

How do I write custom rules for pattern matching in code?▼

Write custom rules for pattern matching by defining syntax patterns that identify specific code quality or security issues. Semgrep allows you to create, test, and apply these customizable rules across multiple programming languages.

What output formats does Semgrep produce for vulnerability findings?▼

Semgrep produces JSON and SARIF outputs to generate actionable findings from security scans. These formats allow integration with downstream tools and platforms for tracking and resolving identified code vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
opengrepopengrep
15

opengrep

Scan codebases for structural patterns and security vulnerabilities using YAML rules.

Official
Intermediate
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced
josuenavarroaguadojosuenavarroaguado

ci-cd-and-automation

Automate GitHub Actions CI/CD pipelines with quality gates and preview deployments.

Community
Advanced
roderikroderik
2

codeql

Identify security vulnerabilities in source code using CodeQL static analysis.

Community
Advanced