skills.rest
trailofbits
trailofbitsOFFICIAL
Explore all skills by this author →
Website𝕏@trailofbitsGitHub

semgrep

Automate static analysis of multi-language codebases with Semgrep parallel subagents.

6.5k|561|Updated Jan 14, 2026
Search Tags:#security#parallel#static-analysis#triage#semgrep#code-scan
One-click install
npx skills add https://github.com/trailofbits/skills --skill semgrep-trailofbits
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/semgrep
Command: npx skills add https://github.com/trailofbits/skills --skill semgrep-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Semgrep-based security scanning across multi-language codebases, coordinating parallel subagents to speed up detection and triage-ready results.

Core Features & Use Cases

  • Parallel Scans: Spawns language-specific scanners to maximize throughput on large repos.
  • Pro + OSS Modes: Uses Semgrep Pro when available for cross-file taint tracking and extra languages.
  • Triage Ready Output: Produces per-language results and a SARIF-friendly summary for downstream triage.

Quick Start

Point Semgrep at your codebase and run the configured rulesets to produce per-language results.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run parallel static analysis scans on a multi-language codebase?▼

Parallel static analysis on multi-language codebases is automated by spawning language-specific subagents that apply appropriate rulesets to maximize scan throughput and produce per-language results.

What is the best way to triage static analysis findings across different programming languages?▼

Triage-ready static analysis findings are generated as per-language SARIF and JSON outputs, providing a SARIF-friendly summary that integrates directly into downstream security audit and triage workflows.

Do I need Semgrep CLI installed to run cross-file taint tracking?▼

Semgrep CLI must be installed to run cross-file taint tracking, and using the Pro mode enables this advanced analysis while the OSS mode handles standard multi-language scanning.

Can I use Semgrep Pro for security audits on large repositories?▼

Semgrep Pro supports security audits on large repositories by enabling cross-file analysis and extra language detection, while parallel subagents coordinate scans to maximize throughput.

How does parallel scanning work with detected languages in a codebase?▼

Parallel scanning works by detecting languages within the codebase and then spawning language-specific subagents that apply targeted rulesets independently to accelerate detection.

Why use cross-file analysis for security scanning instead of standard static analysis?▼

Cross-file analysis enhances security scanning by tracking data flow across multiple files, detecting vulnerabilities that standard static analysis misses when evaluating code in isolation.

Related Skills

Explore More Software Engineering Skills→
camoneartcamoneart
5

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection in CI/CD pipelines.

Community
Advanced
ayehiaaayehiaa

semgrep

Run Semgrep static analysis scans and merge SARIF results.

Community
Advanced
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced
TECHKNOWMAD-LABSTECHKNOWMAD-LABS

security-audit

Scan code repositories for vulnerabilities and leaked secrets using static analysis tools.

Official
Advanced