semgrep
>- Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs…
About
>-
Runs a Semgrep security scan over a codebase: detects languages, selects
rulesets, presents the plan for explicit approval, then runs every approved
ruleset through scripts/run-scans.sh, which batches the semgrep processes and
writes scans.json, and merges the output to SARIF. Supports two scan modes,
"run all" for full ruleset coverage and "important only" for security
findings at medium-to-high confidence and impact. Uses Semgrep Pro for
cross-file taint analysis when it is available. Use when asked to scan code
for vulnerabilities, run a security audit with Semgrep, find bugs, or perform
static analysis. For the same scan without the approval gate, use the
/static-analysis:semgrep-scan workflow.
allowed-tools: Bash Read Glob AskUserQuestion TaskCreate TaskList TaskUpdate
What it can do
- >-
- Runs a Semgrep security scan over a codebase: detects languages, selects
- rulesets, presents the plan for explicit approval, then runs every approved
- ruleset through scripts/run-scans.sh, which batches the semgrep processes and
- writes scans.json, and merges the output to SARIF. Supports two scan modes,
- "run all" for full ruleset coverage and "important only" for security
- findings at medium-to-high confidence and impact. Uses Semgrep Pro for
- cross-file taint analysis when it is available. Use when asked to scan code
- for vulnerabilities, run a security audit with Semgrep, find
Setup
- Install:
npx skills add trailofbits/skills --all - The skill auto-loads when relevant, or invoke it by name in your agent.
Prerequisites
A compatible AI coding agent (Claude Code, Cursor, etc.).
Use cases
Works with
Trust score — 9/10
Trail of Bits is a top-tier security research firm; their skills are professional-grade auditing and fuzzing playbooks used by their own engineers. Open source.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.