skills.rest
ofelixdev
ofelixdevCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

semgrep

Scan codebases with Semgrep to detect security vulnerabilities and bugs.

Updated Feb 24, 2026
Search Tags:#static analysis#security#code audit#devsecops#vulnerability scanning#semgrep
One-click install
npx skills add https://github.com/ofelixdev/cc-kit --skill semgrep-ofelixdev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/ofelixdev/cc-kit/tree/main/template/skills/semgrep
Command: npx skills add https://github.com/ofelixdev/cc-kit --skill semgrep-ofelixdev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the process of scanning codebases for security vulnerabilities and bugs using Semgrep, a powerful static analysis tool.

Core Features & Use Cases

  • Automated Security Scanning: Detects vulnerabilities, bugs, and security misconfigurations across multiple languages.
  • Configurable Modes: Supports "Run all" for comprehensive coverage or "Important only" for high-confidence security findings.
  • Pro Engine Integration: Automatically leverages Semgrep Pro for enhanced cross-file taint analysis when available.
  • Use Case: Before deploying new code, use this Skill to perform a thorough security audit, identifying and reporting potential risks like SQL injection, cross-site scripting, and hardcoded secrets.

Quick Start

Use the semgrep skill to scan the current directory for security vulnerabilities.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for security vulnerabilities and bugs?▼

Static analysis identifies security vulnerabilities, bugs, and misconfigurations by scanning source code without executing it. It detects risks like SQL injection and hardcoded secrets across multiple programming languages before deployment.

What is the best way to automate a security audit before deploying new code?▼

Automating a security audit before deployment involves running static analysis to comprehensively scan for vulnerabilities. You can configure the scan to report all findings or focus strictly on high-confidence security risks.

Does static analysis work for finding hardcoded secrets and cross-site scripting in multiple languages?▼

Yes, static analysis works for finding hardcoded secrets and cross-site scripting across various programming languages. It employs automated language detection and can leverage cross-file taint analysis for comprehensive code auditing.

Can I generate SARIF output to merge vulnerability scanning results?▼

Yes, you can generate SARIF output to merge vulnerability scanning results. This allows you to consolidate findings from parallel scanning processes and integrate them into broader DevSecOps workflows.

How do I run parallel scans for large codebases during a code audit?▼

You can run parallel scans for large codebases during a code audit by utilizing subagents. This parallel scanning approach speeds up the detection of security vulnerabilities and misconfigurations across multiple files.

How can I filter static analysis results to show only high-confidence security findings?▼

You can filter static analysis results to show only high-confidence security findings by using an "Important only" mode. This filters out lower-priority bugs and focuses specifically on verified vulnerabilities and security misconfigurations.

Related Skills

Explore More Software Engineering Skills→
juniorfontenelejuniorfontenele

stack-go

Enforce idiomatic Go patterns, quality gates, and testing guidelines for Go projects.

Community
Intermediate
voidrotvoidrot

sast-configuration

Configure SAST tools like Semgrep, CodeQL, and SonarQube for CI/CD pipelines.

Community
Intermediate
zhangzhang-111-izhangzhang-111-i
2

env-secrets-manager

Scan repositories for environment variable and secret leaks.

Community
Intermediate
FrekiManagarmFrekiManagarm

source-command-sparc-security-review

Perform static and dynamic code audits to flag security vulnerabilities.

Community
Advanced