Semgrep

Run Semgrep security and code quality analysisFrom its SKILL.md

Install

npx -y skills add jmylchreest/aide --skill semgrep

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

16 stars16 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.7 KB, as published. Nobody here has run it

Semgrep Security Analysis

Run Semgrep to detect security vulnerabilities and code quality issues in the codebase.

Workflow

1. Run Semgrep scan

# Auto-detect rules for the project's languages
semgrep scan --config auto --json --quiet 2>/dev/null | head -c 50000

If JSON output is too large, use text output:

semgrep scan --config auto --quiet 2>/dev/null

2. For specific rule sets

# Security-focused rules only
semgrep scan --config "p/security-audit" --json --quiet

# OWASP Top 10
semgrep scan --config "p/owasp-top-ten" --json --quiet

# Language-specific
semgrep scan --config "p/golang" --json --quiet
semgrep scan --config "p/python" --json --quiet
semgrep scan --config "p/typescript" --json --quiet

3. Triage results

For each finding:

Read the file and surrounding context
Assess whether the finding is a true positive or false positive
For true positives, fix the issue following the suggestion in the finding
For false positives, consider adding a # nosemgrep inline comment with justification

4. Scan specific files

# Scan only changed files
semgrep scan --config auto --json --quiet -- path/to/file.py

Common Issues

Too many findings: Use --severity ERROR to focus on critical issues first
Slow scan: Use --config auto instead of multiple rule packs to avoid re-scanning
Missing rules: Install additional rules with semgrep registry
False positives: Add # nosemgrep: rule-id with a comment explaining why