semgrep

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, security, semgrep, static-analysis.

What it does

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill semgrep

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/static-analysis/skills/semgrep ~/.claude/skills/semgrep

Safety box score

Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.

Source

Repository

trailofbits/skills (all skills from this repository)

Path

plugins/static-analysis/skills/semgrep/SKILL.md

Branch

main

Collection

static-analysis

Updated

2026-09-19

Related skills

• codeql — Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis.
• algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
• audit-augmentation — x binary-analysis graph exports. ).
• audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
• audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
• burpsuite-project-parser — burp) from the command line.