skills.rest
0x53c7
0x53c7OFFICIAL
Explore all skills by this author →
GitHub

semgrep-scanner

Run Semgrep scans and return JSON findings with severity, CWE, and OWASP mappings.

1|Updated Mar 6, 2026
Search Tags:#security#owasp#sast#vulnerabilities#semgrep#code-scanning
One-click install
npx skills add https://github.com/0x53c7/security-testing-rovodev-skills --skill semgrep-scanner
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep-scanner
Source: https://github.com/0x53c7/security-testing-rovodev-skills/tree/main/.rovodev/skills/semgrep-scanner
Command: npx skills add https://github.com/0x53c7/security-testing-rovodev-skills --skill semgrep-scanner

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Semgrep SAST scans identify vulnerabilities in codebases and return structured findings with severity, CWE, and OWASP mappings.

Core Features & Use Cases

  • Scans code for security issues using Semgrep's SAST rulesets.
  • Produces a JSON report with check_id, severity, CWE, and OWASP mappings for easy triage.
  • Suitable for automated security reviews in CI/CD pipelines and manual code reviews.

Quick Start

Run a Semgrep scan on the target codebase using the default ruleset and review the structured findings.

Frequently Asked Questions about semgrep-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan source code for OWASP and CWE vulnerabilities?▼

Semgrep SAST scans identify vulnerabilities in source code and return structured findings with severity, CWE, and OWASP mappings. They detect security issues using customizable rulesets across your codebase.

What is the best way to automate Semgrep security scans in CI/CD pipelines?▼

Automating Semgrep scans in CI/CD pipelines produces a JSON report with check_id, severity, and CWE mappings for easy triage. This enables automated security reviews of source code vulnerabilities.

Can I customize Semgrep rulesets to match my project's tech stack?▼

You can apply optional rulesets and use language_context to tailor the SAST scan to your project's tech stack. The workflow uses the p/default ruleset along with any additional rulesets you specify.

Do I need Semgrep installed to run static application security testing?▼

The workflow ensures Semgrep is installed before scanning source code for security issues. This prerequisite allows the SAST scanner to apply rulesets and return structured vulnerability findings.

What format does Semgrep produce for code scanning vulnerability reports?▼

Semgrep produces a JSON report containing check_id, severity, CWE, and OWASP mappings. This structured output ensures easy triage and integration for both manual code reviews and automated security pipelines.

Related Skills

Explore More Software Engineering Skills→
carson-sweetcarson-sweet
6

Corpus Consolidate

Consolidate project source files into a deduplicated corpus using SHA-256 hashing.

Community
Advanced
mahg-esmahg-es
3

secure-code

Review source code for security vulnerabilities with CWE mappings and concrete fixes.

Official
Advanced
thisisqubikathisisqubika

security-review

Analyze code repositories for vulnerabilities using SAST and AI triage.

Official
Advanced
icartshicartsh
4

code-analyze

Analyze .NET solutions for code quality, security, and dependency issues.

Community
Advanced