# semgrep

Runs Semgrep static analysis and helps you write YAML detection rules. Useful when you need to find vulnerabilities or enforce your own coding standards.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2200 installs · ★ 332
- Author: semgrep
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/semgrep/skills/tree/HEAD/skills/semgrep/SKILL.md
- Updated: 2026-07-28
- HTML: https://affpapa.org/en/nevibecode/skills/semgrep-semgrep

## What it does

The skill teaches your agent to drive Semgrep: run scans with ready-made rulesets and author custom detectors. If Semgrep MCP tools are present, the agent prefers them — `semgrep_scan`, `semgrep_scan_with_custom_rule`, `semgrep_findings`, `semgrep_rule_schema` and `get_supported_languages`. Without them it falls back to the CLI.

For injection-style bugs the skill pushes taint mode, which tracks data from a source to a dangerous sink. Plain pattern matching is weaker here: it can't tell `eval(user_input)` from `eval("safe_literal")`. Rules are YAML, and they're verified against test files annotated with `ruleid:` and `ok:` — tests come first, and a rule isn't done until they pass.

Scans run against rulesets such as `p/security-audit`, `p/owasp-top-ten` or `p/cwe-top-25`, and output can be saved as SARIF or JSON. False positives get silenced with a `nosemgrep` comment, while directories like `vendor/` and `node_modules/` are excluded through `.semgrepignore`. One thing to check first: Semgrep itself installs separately — `python3 -m pip install semgrep`, Homebrew or Docker — otherwise the skill has nothing to call.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill semgrep -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/semgrep/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/semgrep/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill semgrep -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/semgrep/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill semgrep -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/semgrep/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install semgrep/skills semgrep
```

2. **Manually: put the files in place**
- File: `.github/skills/semgrep/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill semgrep -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/semgrep/skills --path skills/semgrep
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/semgrep/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add semgrep/skills --skill semgrep -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/semgrep/skills/tree/HEAD/skills/semgrep/SKILL.md

## When to use it
- run a quick security scan over a repo
- write a custom YAML rule for a bug pattern in your codebase
- trace user input flowing into a dangerous call
- silence a false positive without disabling the whole rule
- export scan results as SARIF for CI

## Example prompts
- scan this project for vulnerabilities with semgrep
- write a semgrep rule that catches hardcoded passwords in Python
- check this file with the rule in rule.yaml and show the matches

## Similar
- [semgrep-rule-creator](https://affpapa.org/en/nevibecode/skills/semgrep-rule-creator.md) — skill · 5800 installs
- [semgrep-rule-variant-creator](https://affpapa.org/en/nevibecode/skills/semgrep-rule-variant-creator.md) — skill · 5300 installs
- [security-reviewer](https://affpapa.org/en/nevibecode/skills/security-reviewer.md) — skill · 6000 installs
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [find-bugs](https://affpapa.org/en/nevibecode/skills/find-bugs.md) — skill · 944 installs
- [bug-hunter](https://affpapa.org/en/nevibecode/skills/bug-hunter.md) — skill · 783 installs

## Other versions with the same name
- [semgrep · trailofbits](https://affpapa.org/en/nevibecode/skills/semgrep.md) — 9500 installs

From the same set: [semgrep/skills](https://affpapa.org/en/nevibecode/by/semgrep/skills.md) — 3 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md