semgrep
Performs local static security analysis on changed files using Semgrep.
Install
mkdir -p .claude/skills/semgrep-erikunha && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/11985" && unzip -o skill.zip -d .claude/skills/semgrep-erikunha && rm skill.zipInstalls to .claude/skills/semgrep-erikunha
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Run the pinned Semgrep CLI to statically measure security issues (taint/injection, hardcoded secrets, OWASP Top Ten) on changed files, and interpret the SARIF output. Use ONLY when the user explicitly asks to "run semgrep", "static-analysis the diff", scan for injection/secrets, or interpret a Semgrep SARIF report. Do NOT auto-activate on generic "review my code" — the 4-agent battery and Biome cover that. CI is the authoritative gate; this skill is the local/agent interface.Key capabilities
- →Run Semgrep CLI for static analysis
- →Measure injection sinks
- →Measure taint flows
- →Measure hardcoded secrets
- →Interpret SARIF output
- →Scan changed files
How it works
This skill executes the pinned Semgrep CLI version through a repository wrapper to perform static analysis on specified paths. It then interprets the SARIF output to report security issues.
Inputs & outputs
When to use semgrep
- →Scan files for hardcoded secrets
- →Detect injection sinks during local development
- →Interpret Semgrep security scan results
About this skill
Semgrep (static analysis, on-demand)
Semgrep deterministically measures injection sinks, taint flows, and hardcoded
secrets — the property the security-auditor agent reasons about but cannot
measure. It is a complement to the review battery, not a replacement. The CI
semgrep job (.github/workflows/ci.yml) is authoritative and uploads SARIF to
the code-scanning tab; this skill is the local/agent interface.
Invocation — pinned only
Semgrep is pinned to 1.169.0. Run through the repo wrapper, never a bare global call:
pnpm lint:semgrep # scan app/ lib/ components/ scripts/, write semgrep.sarif
node scripts/run-semgrep.mjs <paths> # scan specific paths
node scripts/run-semgrep.mjs --error --sarif out.sarif <paths>
Local install (optional — CI is authoritative): pip install semgrep==1.169.0.
If Semgrep is not installed, the wrapper exits 2 with an install hint; defer to CI.
Rulesets
- Vendored, content-pinned (
.semgrep/owasp-top-ten.yml,.semgrep/secrets.yml) — the security-load-bearing rules. Edit these files to change behavior; they are the source of truth, immune to registry-side drift. - Registry-latest packs (
p/typescript,p/react,p/nextjs) — framework lint, lower stakes. The Semgrep CLI has no pack version-pinning syntax, so these fetch the latest registry rules (mutable); findings may drift between runs. Drift is accepted for the framework packs (documented in the ADR), which is why the security-load-bearing rules are instead vendored + content-pinned in.semgrep/.
Interpreting SARIF
runs[].results[]— each is one finding.level(error/warning),ruleId,message.text, andlocations[].physicalLocation(file + line).- Zero results in
--errormode → wrapper exits 0. Any result → exits 1. - Triage a finding as real → fix the code; false positive → add a justified
// nosemgrep: <rule-id> — <reason>at the site (never a blanket disable).
Hard rules
- Never disable a rule globally to clear a finding. Fix the code or justify per-line.
- Never edit fixtures under
tests/fixtures/semgrep/to dodge a finding — they are the wrapper's test ground truth. - The CI job is currently non-blocking (
continue-on-error: true). Do not promote it to blocking without a measured FP-rate baseline recorded in DECISIONS.md.
When not to use it
- →When the user asks for generic "review my code"
- →When the CI `semgrep` job is the authoritative gate
- →When not explicitly asked to run semgrep or static analysis
Limitations
- →Semgrep is pinned to `1.169.0`
- →Registry-latest packs fetch mutable rules, which may drift
- →The CI job is currently non-blocking
How it compares
This skill provides on-demand local static analysis with a pinned Semgrep version, complementing the CI's authoritative gate by offering immediate feedback on specific security issues like injection sinks and hardcoded secrets.
Compared to similar skills
semgrep side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| semgrep (this skill) | 0 | 28d | No flags | Intermediate |
| scanning-for-xss-vulnerabilities | 1 | 27d | Review | Intermediate |
| agent-tester | 1 | 6mo | No flags | Intermediate |
| moai-foundation-quality | 0 | 3mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
scanning-for-xss-vulnerabilities
jeremylongshore
Execute this skill enables AI assistant to automatically scan for xss (cross-site scripting) vulnerabilities in code. it is triggered when the user requests to "scan for xss vulnerabilities", "check for xss", or uses the command "/xss". the skill identifies ref... Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.
agent-tester
ruvnet
Agent skill for tester - invoke with $agent-tester
moai-foundation-quality
modu-ai
Enterprise code quality orchestrator with TRUST 5 validation, proactive analysis, and automated best practices enforcement
verification-loop
tom237ttkk
A comprehensive verification system for Codex work sessions.
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.
security-audit
ruvnet
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.