skills.rest
MetalLegBob
MetalLegBobCOMMUNITY
Explore all skills by this author →
GitHub

semgrep

Automate source code security scanning with Semgrep rules.

11|13|Updated Mar 25, 2026
Search Tags:#security#static-analysis#ci-cd#code-review#semgrep#taint-mode#yaml-rules
One-click install
npx skills add https://github.com/MetalLegBob/drfraudsworth --skill semgrep-metallegbob
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/MetalLegBob/drfraudsworth/tree/main/.claude/skills/semgrep
Command: npx skills add https://github.com/MetalLegBob/drfraudsworth --skill semgrep-metallegbob

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Semgrep helps teams quickly identify security vulnerabilities and code quality issues in source code by applying rule-based scanning.

Core Features & Use Cases

  • Quick Scan: Automates fast security scans of codebases with auto-detected rulesets.
  • Rulesets & Custom Rules: Applies default rule sets or custom YAML-based rules tailored to your project.
  • Output Formats & Reporting: Supports JSON, SARIF, and human-readable summaries for CI/CD reports.
  • Taint Mode: Tracks data flow to improve detection of misuses and insecure patterns.
  • CI/CD Integration: Easily incorporate Semgrep scans into existing pipelines.
  • Use Case: Ideal for pre-commit checks, PR reviews, and ongoing security hygiene.

Quick Start

Install Semgrep and run it on your codebase with auto config to get immediate vulnerability findings.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis to find security vulnerabilities in my source code?▼

Static analysis for security vulnerabilities is automated by scanning source code with Semgrep rules. It applies rule-based checks across multiple languages to identify insecure patterns and outputs findings in JSON, SARIF, or human-readable summaries.

How does taint mode data-flow analysis improve security scan results?▼

Taint mode data-flow analysis improves security scanning by tracking how untrusted data moves through your application. This detects vulnerabilities where insecure patterns or misuses occur far from the original data source.

Can I integrate static analysis security scanning into CI/CD pipelines and PR reviews?▼

Static analysis security scanning integrates directly into CI/CD pipelines and PR reviews. It automates pre-commit checks and ongoing security hygiene by applying YAML rules during code review workflows.

How do I write custom YAML rules for code review and security scanning?▼

Custom YAML rules for security scanning are written to enforce project-specific coding standards. You define patterns in YAML syntax, and the scanner applies these custom rulesets alongside default rules to detect vulnerabilities.

What's the best way to get immediate vulnerability findings without writing custom rules?▼

Immediate vulnerability findings are generated by running the scanner with auto-detected rulesets. This quick scan applies default security rules to your codebase, requiring no custom YAML rule configuration to get started.

Related Skills

Explore More Software Engineering Skills→
AidenSbVevoAidenSbVevo
1

semgrep

Run parallelized Semgrep static analysis and merge SARIF results.

Community
Advanced
SuperlendSuperlend

sarif-parsing

Parse SARIF 2.1.0 files and extract structured findings for reporting.

Official
Intermediate
Renzo-TognellaRenzo-Tognella

code-review

Automates code review for Ruby on Rails applications using static analysis tools.

Community
Advanced
ofelixdevofelixdev

semgrep-rule-creator

Generate custom Semgrep rules for security vulnerabilities using test-first development.

Community
Advanced