Agent skill · security · aiskillstore
sast-semgrep
Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based detection, (3) Integrating SAST checks into CI/CD pipelines, (4) Providing remediation guidance with OWASP Top 10 and CWE mappings, (5) Creating custom security rules for organization-specific patterns, (6) Analyzing dependencies for known vulnerabilities.
Why this skill is useful
Adds custom Semgrep rules and CI/CD integration patterns for security scanning that the AI wouldn't reliably generate on its own.
What it needs
Requires git, python, semgrep installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
SAST with Semgrep Overview Perform comprehensive static application security testing using Semgrep, a fast, open-source static analysis tool. This skill provides automated vulnerability detection, security code review workflows, and remediation guidance mapped to OWASP Top 10 and CWE standards. Quick Start Scan a codebase for security vulnerabilities: Run with OWASP Top 10 ruleset: Core Workflows Workflow 1: Initial Security Scan 1. Identify the primary languages in the codebase 2. Run scripts/semgrepscan.py with appropriate rulesets 3. Parse findings and categorize by severity (CRITICAL, HIGH, MEDIUM, LOW) 4. Map findings to OWASP Top 10 and CWE categories 5. Generate prioritized remediation report Workflow 2: Security Code Review 1. For pull requests or commits, run targeted scans on changed files 2. Use semgrep --diff to scan only modified code 3. Flag high-severity findings as blocking issues 4. Provide inline remediation guidance from references/remediationguide.md 5. Link findings to secure coding patterns Workflow 3: Custom Rule Development 1. Identify organization-specific security patterns to detect 2. Create custom Semgrep rules in YAML format using assets/ruletemplate.yaml 3. Test rules against known vulnerable code samples 4. Integrate custom rules into CI/CD pipeline 5. Document rules in references/customrules.md Workflow 4: CI/CD Integration 1. Add Semgrep to CI/CD pipeline using assets/ciconfigexamples/ 2. Configure baseline scanning for pull requests 3. Set severity thresholds (fail on CRITICAL/HIGH) 4. Generate SARIF output for security dashboards 5. Track metrics: vulnerabilities found, fix rate, false positives Security Considerations Sensitive Data Handling: Semgrep scans code locally; ensure scan results don't leak secrets or proprietary code patterns. Use --max-lines-per-finding to limit output. Access Control: Semgrep scans require read access to source code. Restrict scan result access to authorized security and development teams. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/sast-semgrep