semgrep

Name: semgrep
Availability: InStock
Author: jango

Automate code security scanning and pattern detection with Semgrep.

Updated Jan 17, 2026

Search Tags:#ci/cd #security #static-analysis #code-review #semgrep #pattern-matching #taint-mode

Ready to run

npx skills add https://github.com/mejango/juicy-vision --skill semgrep-mejango

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/mejango/juicy-vision/tree/main/.claude/plugins/static-analysis/skills/semgrep
Command: npx skills add https://github.com/mejango/juicy-vision --skill semgrep-mejango

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Semgrep provides fast, pattern-based static analysis to quickly find vulnerabilities, enforce coding standards, and enable security-aware development without heavy, language-specific tooling.

Core Features & Use Cases

Quick scans with auto-detected rules via semgrep --config auto.
Write custom YAML rules to enforce security and quality checks.
Taint-mode data-flow tracking to identify how untrusted input can reach sensitive sinks.
CI/CD integration for automated scanning in pipelines and pull requests.
Output formats like SARIF and JSON for integration with dashboards and alerts.

Quick Start

Install Semgrep with pip, Homebrew, or Docker, then run a basic scan locally.

Install: pip3 install semgrep or brew install semgrep or docker run --rm -v "$PWD:/src" returntocorp/semgrep semgrep --config auto /src
Quick scan: semgrep --config auto .

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run static analysis to find security vulnerabilities in my code?▼

Run static code scanning using `semgrep --config auto` to automatically detect security vulnerabilities and enforce coding standards. This executes pattern-based static analysis across multiple languages without requiring language-specific tooling.

How does taint-mode data flow tracking work for detecting untrusted input?▼

Taint-mode data flow tracking detects how untrusted input reaches sensitive sinks by tracing variable propagation paths. Custom YAML rules define sources and sinks to accurately identify injection vulnerabilities.

How do I integrate static analysis scanning into a CI/CD pipeline?▼

Integrate static analysis scanning into a CI/CD pipeline by running Semgrep commands within your pipeline configuration to automatically scan pull requests. Configure output formats like SARIF or JSON to integrate results with dashboards and alerts.

Can I write custom rules to enforce specific coding standards?▼

Yes, you can write custom YAML rules to enforce specific coding standards and security checks. These rules utilize pattern-matching syntax to target specific code structures and taint-mode tracking across supported languages.

Do I need Docker to run pattern-based static analysis locally?▼

You do not need Docker exclusively; you can install Semgrep via pip3 or Homebrew for local scans. Docker is an alternative option using `docker run --rm -v "$PWD:/src" returntocorp/semgrep semgrep --config auto /src`.