semgrep-security
Semgrep code security scanning and SAST analysis
When & Why to Use This Skill
The Semgrep Security skill empowers Claude to perform professional-grade Static Application Security Testing (SAST) and automated code security scanning. By integrating the powerful Semgrep engine, this skill enables the detection of complex vulnerabilities, hardcoded secrets, and non-compliance with security standards like OWASP Top 10. It is designed to optimize security workflows by providing high-context findings while significantly reducing the manual effort required for security audits and code reviews.
Use Cases
- Automated Vulnerability Detection: Identify critical security flaws such as SQL injection, Cross-Site Scripting (XSS), and insecure dependencies across multiple programming languages including Python, JavaScript, and Go.
- Continuous Integration Security Gates: Utilize the 'scan-ci' tool to implement automated security checks within CI/CD pipelines, preventing high-severity risks from reaching production environments.
- Differential PR Analysis: Use 'scan-diff' to perform lightweight, targeted scans on only the modified code in a Pull Request, ensuring rapid feedback for developers without scanning the entire codebase.
- Credential and Secret Scanning: Leverage the specialized 'p/secrets' ruleset to automatically detect and intercept hardcoded API keys, tokens, and passwords before they are committed to version control.
- Custom Security Policy Enforcement: Create and test custom Semgrep rules to enforce organization-specific coding standards and security best practices across all development teams.
| name | semgrep-security |
|---|---|
| description | Semgrep code security scanning and SAST analysis |
| version | 1.0.0 |
| allowed-tools | [Bash, Read, Glob] |
Semgrep Security Skill
Overview
Static Application Security Testing (SAST) with Semgrep. 90%+ context savings.
Requirements
- Semgrep CLI installed
- Optional: SEMGREP_APP_TOKEN for cloud features
Tools (Progressive Disclosure)
Scanning
| Tool | Description |
|---|---|
| scan | Run security scan |
| scan-ci | CI-optimized scan |
| scan-diff | Scan only changed files |
Rules
| Tool | Description |
|---|---|
| list-rules | List available rules |
| rule-info | Get rule details |
| test-rule | Test custom rule |
Results
| Tool | Description |
|---|---|
| findings | List scan findings |
| sarif-export | Export SARIF format |
| json-export | Export JSON format |
Severity Categories
- ERROR: Critical security issues
- WARNING: Medium severity
- INFO: Low severity/best practices
Agent Integration
- security-architect (primary): Security review
- qa (primary): Quality gates
- code-reviewer (secondary): PR scanning
Common Rulesets
- p/default (general security)
- p/owasp-top-ten
- p/javascript
- p/typescript
- p/python
- p/secrets (credential detection)