semgrep

Run Semgrep static analysis and map findings into scrutineer's format.

Updated May 20, 2026

Search Tags:#security #reporting #static-analysis #semgrep #code-scan #finding-mapping #scrutineer

Ready to run

npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill semgrep-lukehinds

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/semgrep
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill semgrep-lukehinds

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill runs Semgrep against a codebase to identify security and secret-related hits and maps each finding into scrutineer's standard findings format for unified triage and reporting.

Core Features & Use Cases

Run Semgrep with the security-audit and secrets rulesets against your codebase to surface relevant issues.
Map each hit into the scrutineer findings schema (id, title, severity, cwe, location, trace, rating) for consistent downstream processing.
Use as a fast deterministic pass before deeper analyses or for quick security sanity checks.

Quick Start

Run the scan by executing python3 scripts/scan.py > ./report.json

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run Semgrep static code analysis and map the findings to a standard format?▼

Run Semgrep static code analysis by executing `python3 scripts/scan.py > ./report.json`, which scans your codebase and maps security and secret-related findings into the scrutineer schema for unified triage.

What does static analysis with Semgrep and security-audit rulesets detect?▼

Static analysis with Semgrep using security-audit and secrets rulesets detects security vulnerabilities and exposed secrets in your codebase, mapping each hit into a standardized finding format for downstream triage.

Do I need Python and Semgrep installed on my PATH to scan code locally?▼

Yes, you need Python 3 and Semgrep installed and accessible on your PATH to execute local code reviews or CI pipeline scans and generate the standardized findings report.

Can I use this static analysis scan in my CI pipelines for security checks?▼

Yes, you can use this static analysis scan in CI pipelines for security checks; it applies deterministic Semgrep rulesets and outputs a JSON report for automated triage and reporting.

What is the output format for Semgrep findings when running a local code review?▼

The output format for Semgrep findings is a JSON file named `report.json`, containing mapped fields like id, title, severity, cwe, location, trace, and rating for unified triage.

Why use a deterministic static analysis pass before deeper security reviews?▼

A deterministic static analysis pass provides a fast security sanity check and consistent baseline findings before committing resources to deeper, more complex security reviews or analyses.