alivirgo Semgrep Static Analysis AI Skill Guide
Overview & Engine Architecture
Semgrep is a lightweight SAST engine that matches code patterns (and taint rules) across many languages. Teams run packs (OWASP, language defaults) plus custom rules in CI. Agents write precise patterns, scope paths, and treat findings as work items with owners - suppressing only with documented justification.
Repo checkout
-> semgrep ci / semgrep scan
-> Rule packs + custom rules (.yaml)
-> Findings (SARIF/JSON)
-> Gate / triage / suppressions
When to use this skill
- Adding SAST to PR checks
- Authoring custom rules for org-specific footguns
- Reducing false positives with pattern-not and path excludes
- Mapping findings to fix PRs
Operational directives
- Start with curated packs; add custom rules for frameworks you actually use.
- Fail CI on high-confidence rules first; park noisy experimental rules as non-blocking.
- Prefer taint mode for injection-class bugs over brittle syntactic-only patterns when available.
- Never blanket-ignore whole languages or
**without review. - Record ignore reasons next to
nosemgrepcomments or central allowlists.
Scan commands
semgrep --config=auto .
semgrep --config=p/owasp-top-ten --severity=json -o semgrep.json
semgrep --config=./rules/custom.yaml src/
Custom rule sketch
rules:
- id: no-raw-sql-format
languages: [python]
message: "Avoid formatting SQL with f-strings; use parameterized queries"
severity: ERROR
pattern: |
$CURSOR.execute(f"...{$X}...")
Triage hygiene
| Approach | When to use |
|---|---|
| Fix code | True positive, reachable |
Tighten rule (pattern-not, metavariable-regex) |
Recurring false positives |
| Path exclude | Generated code / vendored trees |
Inline nosemgrep |
Rare exceptions with ticket link |
Best practices
- Keep custom rules in-repo versioned next to the code they protect.
- Diff-aware CI (changed files) for speed; full scans nightly.
- Align severities with
@owasp-asvspriorities your team adopted. - Re-tune after major framework upgrades (new APIs create new sinks/sources).
Limitations
- Pattern SAST misses architectural issues and multi-service authz bugs.
- Proprietary or heavily generated code may need different engines (
@codeql). - Rule syntax and pack names evolve - check Semgrep docs for your CLI version.
Related skills
@codeql- deeper semantic analysis in GitHub Advanced Security@owasp-asvs- requirements mapping for findings@snyk- SCA/container companion scanning