semgrep

Name: semgrep
Availability: InStock
Author: metallegbob

Automate source code security scanning with Semgrep rules.

11|13|Updated Mar 25, 2026

Search Tags:#security #static-analysis #ci-cd #code-review #semgrep #taint-mode #yaml-rules

Ready to run

npx skills add https://github.com/MetalLegBob/drfraudsworth --skill semgrep-metallegbob

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/MetalLegBob/drfraudsworth/tree/main/.claude/skills/semgrep
Command: npx skills add https://github.com/MetalLegBob/drfraudsworth --skill semgrep-metallegbob

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Semgrep helps teams quickly identify security vulnerabilities and code quality issues in source code by applying rule-based scanning.

Core Features & Use Cases

Quick Scan: Automates fast security scans of codebases with auto-detected rulesets.
Rulesets & Custom Rules: Applies default rule sets or custom YAML-based rules tailored to your project.
Output Formats & Reporting: Supports JSON, SARIF, and human-readable summaries for CI/CD reports.
Taint Mode: Tracks data flow to improve detection of misuses and insecure patterns.
CI/CD Integration: Easily incorporate Semgrep scans into existing pipelines.
Use Case: Ideal for pre-commit checks, PR reviews, and ongoing security hygiene.

Quick Start

Install Semgrep and run it on your codebase with auto config to get immediate vulnerability findings.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run static analysis to find security vulnerabilities in my source code?▼

Static analysis for security vulnerabilities is automated by scanning source code with Semgrep rules. It applies rule-based checks across multiple languages to identify insecure patterns and outputs findings in JSON, SARIF, or human-readable summaries.

How does taint mode data-flow analysis improve security scan results?▼

Taint mode data-flow analysis improves security scanning by tracking how untrusted data moves through your application. This detects vulnerabilities where insecure patterns or misuses occur far from the original data source.

Can I integrate static analysis security scanning into CI/CD pipelines and PR reviews?▼

Static analysis security scanning integrates directly into CI/CD pipelines and PR reviews. It automates pre-commit checks and ongoing security hygiene by applying YAML rules during code review workflows.

How do I write custom YAML rules for code review and security scanning?▼

Custom YAML rules for security scanning are written to enforce project-specific coding standards. You define patterns in YAML syntax, and the scanner applies these custom rulesets alongside default rules to detect vulnerabilities.

What's the best way to get immediate vulnerability findings without writing custom rules?▼

Immediate vulnerability findings are generated by running the scanner with auto-detected rulesets. This quick scan applies default security rules to your codebase, requiring no custom YAML rule configuration to get started.