semgrep · semgrep — Claude Code skill: code scans and custom rules
Runs Semgrep static analysis and helps you write YAML detection rules. Useful when you need to find vulnerabilities or enforce your own coding standards.
npx skills add semgrep/skills --skill semgrep -a claude-codeWhat semgrep does
The skill teaches your agent to drive Semgrep: run scans with ready-made rulesets and author custom detectors. If Semgrep MCP tools are present, the agent prefers them — semgrep_scan, semgrep_scan_with_custom_rule, semgrep_findings, semgrep_rule_schema and get_supported_languages. Without them it falls back to the CLI.
For injection-style bugs the skill pushes taint mode, which tracks data from a source to a dangerous sink. Plain pattern matching is weaker here: it can't tell eval(user_input) from eval("safe_literal"). Rules are YAML, and they're verified against test files annotated with ruleid: and ok: — tests come first, and a rule isn't done until they pass.
Scans run against rulesets such as p/security-audit, p/owasp-top-ten or p/cwe-top-25, and output can be saved as SARIF or JSON. False positives get silenced with a nosemgrep comment, while directories like vendor/ and node_modules/ are excluded through .semgrepignore. One thing to check first: Semgrep itself installs separately — python3 -m pip install semgrep, Homebrew or Docker — otherwise the skill has nothing to call.
What it helps with
- run a quick security scan over a repo
- write a custom YAML rule for a bug pattern in your codebase
- trace user input flowing into a dangerous call
- silence a false positive without disabling the whole rule
- export scan results as SARIF for CI
Example prompts for the agent
- scan this project for vulnerabilities with semgrep
- write a semgrep rule that catches hardcoded passwords in Python
- check this file with the rule in rule.yaml and show the matches
How to install semgrep
1Skills CLI (Vercel)
npx skills add semgrep/skills --skill semgrep -a claude-code2Manually: put the files in place
~/.claude/skills/semgrep/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/semgrep/
1Skills CLI (Vercel)
npx skills add semgrep/skills --skill semgrep -a codex2Manually: put the files in place
.agents/skills/semgrep/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add semgrep/skills --skill semgrep -a cursor2Manually: put the files in place
.cursor/skills/semgrep/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install semgrep/skills semgrep2Manually: put the files in place
.github/skills/semgrep/SKILL.md1Skills CLI (Vercel)
npx skills add semgrep/skills --skill semgrep -a gemini-cli2Platform CLI
gemini skills install https://github.com/semgrep/skills --path skills/semgrepManually: put the files in place
.devin/skills/semgrep/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add semgrep/skills --skill semgrep -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about semgrep
How do I install semgrep in Claude?
Run npx skills add semgrep/skills --skill semgrep -a claude-code. The skill file then lands at ~/.claude/skills/semgrep/SKILL.md.
What does the semgrep skill do?
It runs static analysis on your code and helps you build custom detection rules. The agent picks between Semgrep MCP tools and the command line.
Do I need Semgrep installed for the skill to work?
Yes, the CLI path needs Semgrep itself: python3 -m pip install semgrep, Homebrew or Docker. If Semgrep MCP tools are available, scans go through those instead.
Similar skills
Everything for Security →semgrep by other authors comes first.
