skills.rest
jikig-ai
jikig-aiOFFICIAL
Explore all skills by this author →
GitHub

semgrep-sast

Scan git-diff-selected source files with semgrep for vulnerability patterns.

12|2|Updated Jan 27, 2026
Search Tags:#security#sast#static-analysis#semgrep#code-scanning#secrets-detection#cwe
One-click install
npx skills add https://github.com/jikig-ai/soleur --skill semgrep-sast
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep-sast
Source: https://github.com/jikig-ai/soleur/tree/main/.openhands/skills/semgrep-sast
Command: npx skills add https://github.com/jikig-ai/soleur --skill semgrep-sast

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill performs deterministic static analysis to catch known vulnerability signatures, hardcoded secrets, insecure function calls, and CWE patterns that probabilistic LLM-based reviews can miss, improving the reliability of security-focused code reviews.

Core Features & Use Cases

  • Deterministic Pattern Matching: Execute semgrep rule-based scans to identify known insecure code patterns and secrets that statistical models may overlook.
  • Changed-files Only Scanning: Limit analysis to files modified in the current diff to reduce noise and avoid aggregating repository-wide findings.
  • Structured, Inline Findings: Report file/line, rule ID, CWE if present, code snippet, and remediation guidance grouped by severity without writing results to disk.
  • Graceful Degradation: Detect missing or failing semgrep installations and skip scanning with a clear warning instead of blocking the review.
  • Use Case: Run this Skill during a pull request review to automatically surface hardcoded credentials or insecure API usage introduced by the change.

Quick Start

Run semgrep-sast to scan only the changed files in this pull request and return grouped, inline findings.

Frequently Asked Questions about semgrep-sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis on changed files in a pull request to find hardcoded secrets?▼

Static analysis on changed pull request files catches hardcoded secrets by running semgrep with JSON output on git-diff-selected files, returning inline findings grouped by severity without writing scan results to disk.

Can I detect CWE vulnerability patterns during code review without scanning the entire repository?▼

Detecting CWE vulnerability patterns during code review is possible by limiting semgrep scans to changed files, reducing noise and avoiding the aggregation of repository-wide findings.

Do I need to install the semgrep CLI to scan for insecure function calls?▼

Yes, scanning for insecure function calls requires the semgrep CLI to be installed locally to run deterministic rule-based scans with JSON output on the selected source code.

Why use deterministic static analysis instead of LLM-based code reviews for security?▼

Deterministic static analysis improves security reviews by catching known vulnerability signatures and hardcoded secrets that probabilistic LLM-based code reviews often miss.

What happens if the semgrep installation is missing when running source code scanning?▼

If the semgrep CLI is missing or failing, source code scanning gracefully degrades by skipping the scan with a clear warning instead of blocking the code review workflow.

Related Skills

Explore More Software Engineering Skills→
reedomreedom

collect-commits-and-files

Collect and categorize changed files from Git for review workflows.

Community
Advanced
D3HunterD3Hunter

merge-review-json-and-submit-pr-review

Merge review JSON files and submit consolidated GitHub PR reviews.

Community
Intermediate
ameenalkhaldiameenalkhaldi

irab

Perform rule-based Arabic grammatical case analysis with deterministic morphological parsing.

Community
Advanced
Oruga420Oruga420

bughunter

Scan codebases for bugs, vulnerabilities, and quality issues with static analysis.

Community
Advanced