semgrep

Automate static analysis of multi-language codebases with Semgrep parallel subagents.

6.5k|561|Updated Jan 14, 2026

Search Tags:#security #parallel #static-analysis #triage #semgrep #code-scan

Ready to run

npx skills add https://github.com/trailofbits/skills --skill semgrep-trailofbits

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: semgrep
Source: https://github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/semgrep
Command: npx skills add https://github.com/trailofbits/skills --skill semgrep-trailofbits

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Semgrep-based security scanning across multi-language codebases, coordinating parallel subagents to speed up detection and triage-ready results.

Core Features & Use Cases

Parallel Scans: Spawns language-specific scanners to maximize throughput on large repos.
Pro + OSS Modes: Uses Semgrep Pro when available for cross-file taint tracking and extra languages.
Triage Ready Output: Produces per-language results and a SARIF-friendly summary for downstream triage.

Quick Start

Point Semgrep at your codebase and run the configured rulesets to produce per-language results.

Frequently Asked Questions about semgrep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run parallel static analysis scans on a multi-language codebase?▼

Parallel static analysis on multi-language codebases is automated by spawning language-specific subagents that apply appropriate rulesets to maximize scan throughput and produce per-language results.

What is the best way to triage static analysis findings across different programming languages?▼

Triage-ready static analysis findings are generated as per-language SARIF and JSON outputs, providing a SARIF-friendly summary that integrates directly into downstream security audit and triage workflows.

Do I need Semgrep CLI installed to run cross-file taint tracking?▼

Semgrep CLI must be installed to run cross-file taint tracking, and using the Pro mode enables this advanced analysis while the OSS mode handles standard multi-language scanning.

Can I use Semgrep Pro for security audits on large repositories?▼

Semgrep Pro supports security audits on large repositories by enabling cross-file analysis and extra language detection, while parallel subagents coordinate scans to maximize throughput.

How does parallel scanning work with detected languages in a codebase?▼

Parallel scanning works by detecting languages within the codebase and then spawning language-specific subagents that apply targeted rulesets independently to accelerate detection.

Why use cross-file analysis for security scanning instead of standard static analysis?▼

Cross-file analysis enhances security scanning by tracking data flow across multiple files, detecting vulnerabilities that standard static analysis misses when evaluating code in isolation.