skills.rest
lukehinds
lukehindsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

semgrep

Run Semgrep static analysis and map findings into scrutineer's format.

Updated May 20, 2026
Search Tags:#security#reporting#static-analysis#semgrep#code-scan#finding-mapping#scrutineer
One-click install
npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill semgrep-lukehinds
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/semgrep
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill semgrep-lukehinds

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill runs Semgrep against a codebase to identify security and secret-related hits and maps each finding into scrutineer's standard findings format for unified triage and reporting.

Core Features & Use Cases

  • Run Semgrep with the security-audit and secrets rulesets against your codebase to surface relevant issues.
  • Map each hit into the scrutineer findings schema (id, title, severity, cwe, location, trace, rating) for consistent downstream processing.
  • Use as a fast deterministic pass before deeper analyses or for quick security sanity checks.

Quick Start

Run the scan by executing python3 scripts/scan.py > ./report.json

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run Semgrep static code analysis and map the findings to a standard format?▼

Run Semgrep static code analysis by executing `python3 scripts/scan.py > ./report.json`, which scans your codebase and maps security and secret-related findings into the scrutineer schema for unified triage.

What does static analysis with Semgrep and security-audit rulesets detect?▼

Static analysis with Semgrep using security-audit and secrets rulesets detects security vulnerabilities and exposed secrets in your codebase, mapping each hit into a standardized finding format for downstream triage.

Do I need Python and Semgrep installed on my PATH to scan code locally?▼

Yes, you need Python 3 and Semgrep installed and accessible on your PATH to execute local code reviews or CI pipeline scans and generate the standardized findings report.

Can I use this static analysis scan in my CI pipelines for security checks?▼

Yes, you can use this static analysis scan in CI pipelines for security checks; it applies deterministic Semgrep rulesets and outputs a JSON report for automated triage and reporting.

What is the output format for Semgrep findings when running a local code review?▼

The output format for Semgrep findings is a JSON file named `report.json`, containing mapped fields like id, title, severity, cwe, location, trace, and rating for unified triage.

Why use a deterministic static analysis pass before deeper security reviews?▼

A deterministic static analysis pass provides a fast security sanity check and consistent baseline findings before committing resources to deeper, more complex security reviews or analyses.

Related Skills

Explore More Software Engineering Skills→
roderikroderik
2

semgrep

Scan codebases with YAML rules to detect security vulnerabilities and quality issues.

Community
Advanced
lukehindslukehinds

zizmor

Scan GitHub Actions workflows for security issues and output scrutineer findings JSON.

Community
Intermediate
lukehindslukehinds

disclose

Draft GHSA-style advisory disclosures from scrutineer finding data.

Community
Advanced
RangeyRoverRangeyRover
3

speckit.checker

Run static analysis across multiple languages and generate prioritized issue reports.

Community
Intermediate