How do I install the Semgrep skill?

Run npx skillmds@latest add lftpadilla/semgrep in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Semgrep safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Semgrep?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Semgrep free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Semgrep?

LFTPadilla (@lftpadilla) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Semgrep by lftpadilla — Agent Skill

Name: Semgrep
Author: LFTPadilla

Semgrep

Run static analysis (SAST) over the codebase with semgrep to find real bug and security patterns — injection, auth gaps, secret handling, dangerous APIs. Use before a security-sensitive PR, on auth/payment/data-handling code, or when the user asks for a deterministic security scan.

LFTPadilla ac61f33 1.9 KB Updated Sep 17, 2026

File contents

semgrep — static analysis / SAST

Pattern-based static analysis. Deterministic, fast, rule-driven — the complement to an LLM security review: semgrep never misses a known pattern, the LLM reasons about novel ones. Run both.

Run

semgrep --config auto                 # auto-select rules for the detected languages
semgrep --config p/typescript         # registry rule pack (TS)
semgrep --config p/javascript
semgrep --config p/owasp-top-ten      # OWASP Top 10 patterns
semgrep --config p/secrets            # hardcoded secrets
semgrep --config p/nodejs             # Node-specific
semgrep --config auto --json          # machine-readable for processing

Scope to a diff for speed:

semgrep --config auto $(git diff --name-only --diff-filter=ACM main)

Install: pipx install semgrep (or brew install semgrep). No global install? pipx run semgrep ....

How to use the output

Pick rule packs by the code under review — p/owasp-top-ten + p/secrets for auth/payment surfaces; p/typescript for general correctness.
Triage findings by severity. Confirm each against the real code — semgrep patterns can false-positive on guarded paths.
For a PR, scan only the diff (above) to keep it fast.
Report: rule id, file:line, why it matters, fix. Don't auto-apply on security code without confirmation.

Gotchas

--config auto phones the registry; for offline/CI pin explicit p/... packs.
Custom rules go in .semgrep.yml — but prefer registry packs first (YAGNI).
Pairs with the security-review skill: semgrep catches known patterns, the review reasons about the rest.

---name: semgrepdescription: Run static analysis (SAST) over the codebase with semgrep to find real bug and security patterns — injection, auth gaps, secret handling, dangerous APIs. Use before a security-sensitive PR, on auth/payment/data-handling code, or when the user asks for a deterministic security scan.---# semgrep — static analysis / SASTPattern-based static analysis. Deterministic, fast, rule-driven — thecomplement to an LLM security review: semgrep never misses a known pattern,the LLM reasons about novel ones. Run both.## Run```bashsemgrep --config auto # auto-select rules for the detected languagessemgrep --config p/typescript # registry rule pack (TS)semgrep --config p/javascriptsemgrep --config p/owasp-top-ten # OWASP Top 10 patternssemgrep --config p/secrets # hardcoded secretssemgrep --config p/nodejs # Node-specificsemgrep --config auto --json # machine-readable for processing```Scope to a diff for speed:```bashsemgrep --config auto $(git diff --name-only --diff-filter=ACM main)```Install: `pipx install semgrep` (or `brew install semgrep`). No global install? `pipx run semgrep ...`.## How to use the output1. Pick rule packs by the code under review — `p/owasp-top-ten` + `p/secrets` for auth/payment surfaces; `p/typescript` for general correctness.2. Triage findings by severity. Confirm each against the real code — semgrep patterns can false-positive on guarded paths.3. For a PR, scan only the diff (above) to keep it fast.4. Report: rule id, file:line, why it matters, fix. Don't auto-apply on security code without confirmation.## Gotchas- `--config auto` phones the registry; for offline/CI pin explicit `p/...` packs.- Custom rules go in `.semgrep.yml` — but prefer registry packs first (YAGNI).- Pairs with the `security-review` skill: semgrep catches known patterns, the review reasons about the rest.

Frequently asked questions