skills.rest
mejango
mejangoCOMMUNITY
Explore all skills by this author →
𝕏@me_jangoGitHub

semgrep

Automate code security scanning and pattern detection with Semgrep.

Updated Jan 17, 2026
Search Tags:#ci/cd#security#static-analysis#code-review#semgrep#pattern-matching#taint-mode
One-click install
npx skills add https://github.com/mejango/juicy-vision --skill semgrep-mejango
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/mejango/juicy-vision/tree/main/.claude/plugins/static-analysis/skills/semgrep
Command: npx skills add https://github.com/mejango/juicy-vision --skill semgrep-mejango

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Semgrep provides fast, pattern-based static analysis to quickly find vulnerabilities, enforce coding standards, and enable security-aware development without heavy, language-specific tooling.

Core Features & Use Cases

  • Quick scans with auto-detected rules via semgrep --config auto.
  • Write custom YAML rules to enforce security and quality checks.
  • Taint-mode data-flow tracking to identify how untrusted input can reach sensitive sinks.
  • CI/CD integration for automated scanning in pipelines and pull requests.
  • Output formats like SARIF and JSON for integration with dashboards and alerts.

Quick Start

Install Semgrep with pip, Homebrew, or Docker, then run a basic scan locally.

  • Install: pip3 install semgrep or brew install semgrep or docker run --rm -v "$PWD:/src" returntocorp/semgrep semgrep --config auto /src
  • Quick scan: semgrep --config auto .

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis to find security vulnerabilities in my code?▼

Run static code scanning using `semgrep --config auto` to automatically detect security vulnerabilities and enforce coding standards. This executes pattern-based static analysis across multiple languages without requiring language-specific tooling.

How does taint-mode data flow tracking work for detecting untrusted input?▼

Taint-mode data flow tracking detects how untrusted input reaches sensitive sinks by tracing variable propagation paths. Custom YAML rules define sources and sinks to accurately identify injection vulnerabilities.

How do I integrate static analysis scanning into a CI/CD pipeline?▼

Integrate static analysis scanning into a CI/CD pipeline by running Semgrep commands within your pipeline configuration to automatically scan pull requests. Configure output formats like SARIF or JSON to integrate results with dashboards and alerts.

Can I write custom rules to enforce specific coding standards?▼

Yes, you can write custom YAML rules to enforce specific coding standards and security checks. These rules utilize pattern-matching syntax to target specific code structures and taint-mode tracking across supported languages.

Do I need Docker to run pattern-based static analysis locally?▼

You do not need Docker exclusively; you can install Semgrep via pip3 or Homebrew for local scans. Docker is an alternative option using `docker run --rm -v "$PWD:/src" returntocorp/semgrep semgrep --config auto /src`.

Related Skills

Explore More Software Engineering Skills→
dakshrawat298-gifdakshrawat298-gif

static-analysis

Parse and unify static-analysis tool outputs to identify vulnerabilities across codebases.

Community
Advanced
SuperlendSuperlend

sarif-parsing

Parse SARIF 2.1.0 files and extract structured findings for reporting.

Official
Intermediate
villads-valurvillads-valur

code-reviewer

Review code for quality, security, and best practices.

Community
Intermediate
allanninalallanninal
1

semgrep-rule-creator

Generate custom Semgrep rules for security vulnerability detection and code pattern enforcement.

Community
Advanced