semgrep
semgrep
What it does
- Security audit of a codebase
- Finding vulnerabilities before code review
- Scanning for known bug patterns
- First-pass static analysis
- Binary analysis → Use binary analysis tools
- Already have Semgrep CI configured → Use existing pipeline
- Need cross-file analysis but no Pro license → Consider CodeQL as alternative
Requirements & configuration
- Need cross-file analysis but no Pro license → Consider CodeQL as alternative
- | "Use . or relative path as target" | Subagents need absolute paths to avoid ambiguity |
Configuration: OUTPUT_DIRUSER_SPECIFIED_DIR
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
semgrep FAQ
What does the semgrep skill do?
>- Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes — "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases. Security audit of a codebase Finding vulnerabilities before code review
What does semgrep require?
Need cross-file analysis but no Pro license → Consider CodeQL as alternative | "Use . or relative path as target" | Subagents need absolute paths to avoid ambiguity | Configuration keys: OUTPUT_DIR, USER_SPECIFIED_DIR.
How do I install semgrep?
Run: npx -y skills add https://github.com/trailofbits/skills --skill semgrep --agent claude-code — the source lives at github.com/trailofbits/skills.
Maintain semgrep?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/trailofbits-skills-semgrep?ref=badge) npx agentictools info skills/trailofbits-skills-semgrep The second line is the CLI lookup for this page — handy in READMEs and docs.
