# Semgrep

> Use for white-box application review, code pattern analysis, and secure design verification during authorized pentests. Trigger on source code access, framework-specific review, and validating whether runtime findings are supported by reachable code paths.

- Skill: `timsonner/semgrep` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/semgrep`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/semgrep/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/semgrep

---


# Semgrep

## Purpose

Use this skill when source code is available and the methodology benefits from white-box validation or faster hypothesis generation.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Threat Modeling and Test Planning, Retest and Closure

## Use When

- Need to review code patterns tied to authentication, authorization, input handling, or secrets.
- Need to validate whether a runtime issue is likely reachable in code.
- Need to retest a remediation by verifying the code path changed as intended.

## Avoid When

- No source code or build context is available.
- Rule output would be reported without human review and reachability analysis.

## Inputs

- Source tree, language, and framework context
- Relevant rule sets and excluded generated code
- Targeted hypotheses from runtime or architecture review

## Procedure

1. Scope the review to relevant languages and reachable components.
2. Run only rule sets that match the current hypotheses.
3. Triage matches for false positives, dead code, and non-reachable patterns.
4. Correlate material matches with runtime behavior or architecture.
5. Translate confirmed issues into code-aware remediation guidance.

## Command Syntax

Replace sample paths with the approved source tree.

```bash
# Auto-detect best rules for the codebase
semgrep --config auto src/

# Scan with OWASP Top 10 ruleset
semgrep --config p/owasp-top-ten /path/to/contoso-webapp/

# Security audit ruleset
semgrep --config p/security-audit /path/to/contoso-webapp/

# Secrets detection
semgrep --config p/secrets /path/to/contoso-webapp/

# Output to SARIF for integration with security tooling
semgrep --config p/owasp-top-ten /path/to/contoso-webapp/ --sarif --output contoso-semgrep.sarif

# Run multiple rulesets
semgrep --config p/owasp-top-ten --config p/secrets /path/to/contoso-webapp/

# Exclude paths
semgrep --config p/owasp-top-ten /path/to/contoso-webapp/ --exclude='node_modules' --exclude='*.test.js'
```

## Evidence to Capture

- File and function context for confirmed risky patterns
- Reachability notes that justify severity
- Code changes to verify during retest

## Safety Boundaries

- Do not equate pattern matches with exploitable findings automatically.
- Exclude generated, vendored, or out-of-scope code from conclusions.