skills.rest
kissrosecicd-hub
kissrosecicd-hubCOMMUNITY
Explore all skills by this author →
GitHub

semgrep

Coordinate parallel Semgrep scans across multi-language codebases and merge SARIF results.

31|4|Updated Apr 6, 2026
Search Tags:#security#parallel#static-analysis#semgrep#multilang#sarif
One-click install
npx skills add https://github.com/kissrosecicd-hub/agents-evolution --skill semgrep-kissrosecicd-hub
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/kissrosecicd-hub/agents-evolution/tree/main/.agents/skills/tob-static-analysis
Command: npx skills add https://github.com/kissrosecicd-hub/agents-evolution --skill semgrep-kissrosecicd-hub

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Automates fast, scalable static analysis of multi-language codebases by coordinating parallel Semgrep scans through subagents, reducing time-to-results and ensuring consistent governance.

Core Features & Use Cases

  • Parallel Semgrep scans using language-specific subagents to speed up analyses across large codebases.
  • Automatic language detection and Semgrep Pro cross-file analysis when available.
  • Two scan modes: Run all (full ruleset coverage) and Important only (high-confidence security findings), with merged SARIF output.
  • Output management: per-scan raw SARIF under raw/ and a merged results file under results/, with optional cloning of third-party rule repos.
  • Governance: Stepwise workflow with a hard gate to require explicit approval before scanning.

Quick Start

Run Semgrep scans on your codebase using parallel subagents and merge the results.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run parallel static analysis scans across a multi-language codebase?▼

You can run parallel static analysis by deploying language-specific subagents that apply per-language rulesets concurrently. The Skill automates this coordination and merges the separate scan outputs into a single SARIF file.

Does Semgrep support automatic language detection for vulnerability discovery?▼

Semgrep supports automatic language detection to apply appropriate rulesets during vulnerability discovery. When Semgrep Pro is available, it optionally extends this process with cross-file analysis for deeper security audits.

What is the difference between run-all and important-only scan modes for security audits?▼

Run-all mode provides full ruleset coverage for comprehensive security audits, while important-only mode filters for high-confidence security findings. Both modes execute parallel scans and merge results into a single SARIF output file.

Can I merge multiple SARIF outputs from separate static analysis scans?▼

Merging multiple SARIF outputs is supported by storing per-scan raw results under a raw directory and combining them into a final merged SARIF file under a results directory. This ensures consistent governance across parallel scans.

How do I gate static analysis workflows to require explicit approval before scanning?▼

Static analysis workflows can be gated using a stepwise process with a hard gate that requires explicit approval before scanning begins. This ensures isolated execution and proper output management for security audits.

Related Skills

Explore More Software Engineering Skills→
lidge-junlidge-jun
5

semgrep

Execute Semgrep static analysis scans to detect vulnerabilities and code quality issues.

Community
Advanced
roderikroderik
2

sarif-parsing

Parse SARIF 2.1.0 files to extract, deduplicate, and summarize findings.

Community
Basic
sandeshbagmaresandeshbagmare

secrets-management

Integrate third-party secrets managers into CI/CD workflows for secure credential handling.

Community
Intermediate
manuelbrandner85manuelbrandner85

semgrep

Execute parallel static analysis scans to detect security vulnerabilities and bug patterns.

Community
Advanced