# Semgrep > Run Semgrep static analysis for fast security scanning and pattern matching. Use when asked to scan code with Semgrep, write custom YAML rules, find vulnerabilities quickly, use taint mode, or set up Semgrep in CI/CD pipelines. Use when this capability is needed. - Skill: `tomevault-io/semgrep` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/semgrep` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/semgrep/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/semgrep --- # Semgrep Skill **Trit**: -1 (MINUS) **Category**: static-analysis **Author**: Trail of Bits **Source**: trailofbits/skills **License**: AGPL-3.0 ## Description Run Semgrep static analysis for fast security scanning and pattern matching. Use when asked to scan code with Semgrep, write custom YAML rules, find vulnerabilities quickly, use taint mode, or set up Semgrep in CI/CD pipelines. ## When to Use This is a Trail of Bits security skill. Refer to the original repository for detailed usage guidelines and examples. See: https://github.com/trailofbits/skills ## Related Skills - audit-context-building - codeql - semgrep - variant-analysis ## SDF Interleaving This skill connects to **Software Design for Flexibility** (Hanson & Sussman, 2021): ### Primary Chapter: 4. Pattern Matching **Concepts**: unification, match, segment variables, pattern ### GF(3) Balanced Triad ``` semgrep (+) + SDF.Ch4 (+) + [balancer] (+) = 0 ``` **Skill Trit**: 1 (PLUS - generation) ### Connection Pattern Pattern matching extracts structure. This skill recognizes and transforms patterns. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/plurigrid) — claim your Tome and manage your conversions.