semgrep-sast

What problem does it solve?

This Skill performs deterministic static analysis to catch known vulnerability signatures, hardcoded secrets, insecure function calls, and CWE patterns that probabilistic LLM-based reviews can miss, improving the reliability of security-focused code reviews.

Core Features & Use Cases

• Deterministic Pattern Matching: Execute semgrep rule-based scans to identify known insecure code patterns and secrets that statistical models may overlook.
• Changed-files Only Scanning: Limit analysis to files modified in the current diff to reduce noise and avoid aggregating repository-wide findings.
• Structured, Inline Findings: Report file/line, rule ID, CWE if present, code snippet, and remediation guidance grouped by severity without writing results to disk.
• Graceful Degradation: Detect missing or failing semgrep installations and skip scanning with a clear warning instead of blocking the review.
• Use Case: Run this Skill during a pull request review to automatically surface hardcoded credentials or insecure API usage introduced by the change.

Quick Start

Run semgrep-sast to scan only the changed files in this pull request and return grouped, inline findings.