Run parallel Semgrep static analysis scans and merge findings into SARIF reports.
npx skills add https://github.com/TECH-HY/SKILLS --skill semgrep-tech-hy
Please help me install this Agent Skill. Skill: semgrep Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/semgrep Command: npx skills add https://github.com/TECH-HY/SKILLS --skill semgrep-tech-hy
--metrics=off on every command to prevent telemetry leakage. - Merged SARIF output: Consolidates per-ruleset scan results into a single deduplicated results.sarif file using a merge script with a pure-Python fallback. - Use Case: Before a release, ask the agent to audit your repository; it detects a Python/Django and React stack, proposes rulesets including Trail of Bits third-party rules, waits for your approval, then runs all scans in parallel and reports findings by severity and category. ## Quick Start Ask the agent to scan this codebase for security vulnerabilities with Semgrep and approve the proposed scan plan when prompted.High-intent search queries and answers about installing and using this skill.
Invoke the skill with a scan request; it detects languages and frameworks, proposes rulesets per language, and spawns parallel scanner subagents after you approve the plan. Results from all rulesets are merged into a single SARIF file in the output directory.
Run-all reports every finding from all rulesets at all severity levels. Important-only pre-filters with --severity MEDIUM/HIGH/CRITICAL and post-filters JSON metadata to keep only security-category findings with medium-high confidence and impact.
Cross-file taint tracking requires Semgrep Pro, which the skill detects automatically before scanning. In OSS mode, analysis is limited to single files, so the skill notes this limitation and suggests CodeQL as an alternative when Pro is unavailable.
Step 3 is a hard gate ensuring you review the exact target, engine, scan mode, and ruleset list before execution. The original scan request does not count as approval; you must explicitly confirm or modify the plan first.
Avoid it for binary analysis, when a Semgrep CI pipeline already exists, or when you need cross-file analysis without a Pro license. For creating custom rules, use the semgrep-rule-creator skill instead.
The merge_sarif.py script combines all per-ruleset SARIF files from the raw output directory, deduplicating findings by rule ID, file URI, and line number. It prefers the SARIF Multitool via npx and falls back to a pure-Python merge.
TimMoyenceRun parallel Semgrep scans across multi-language repositories and merge SARIF results.
promptfooReviews code for bugs, security vulnerabilities, and best practice violations.
ag47-ptIdentify and prioritize software vulnerabilities across code, dependencies, and configurations.
AI-SafeterConfigure and automate SAST tooling for CI/CD vulnerability detection.