Semgrep

Skill LFTPadilla/agent-dev-kit/plugins/dev-skills/skills/semgrep

Replicable agent development system: curated Claude Code/Codex skills + bootstrap for the external tools (GSD, caveman, ponytail) that complete the stack.

Install

npx -y skills add LFTPadilla/agent-dev-kit --skill semgrep

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Run static analysis (SAST) over the codebase with semgrep to find real bug and security patterns — injection, auth gaps, secret handling, dangerous APIs. Use before a security-sensitive PR, on auth/payment/data-handling code, or when the user asks for a deterministic security scan.

SKILL.md

1.9 KB, as published. Nobody here has run it

semgrep — static analysis / SAST

Pattern-based static analysis. Deterministic, fast, rule-driven — the complement to an LLM security review: semgrep never misses a known pattern, the LLM reasons about novel ones. Run both.

Run

semgrep --config auto                 # auto-select rules for the detected languages
semgrep --config p/typescript         # registry rule pack (TS)
semgrep --config p/javascript
semgrep --config p/owasp-top-ten      # OWASP Top 10 patterns
semgrep --config p/secrets            # hardcoded secrets
semgrep --config p/nodejs-scan        # Node-specific
semgrep --config auto --json          # machine-readable for processing

Scope to a diff for speed:

semgrep --config auto $(git diff --name-only --diff-filter=ACM main)

Install: pipx install semgrep (or brew install semgrep). No global install? pipx run semgrep ....

How to use the output

Pick rule packs by the code under review — p/owasp-top-ten + p/secrets for auth/payment surfaces; p/typescript for general correctness.
Triage findings by severity. Confirm each against the real code — semgrep patterns can false-positive on guarded paths.
For a PR, scan only the diff (above) to keep it fast.
Report: rule id, file:line, why it matters, fix. Don't auto-apply on security code without confirmation.

Gotchas

--config auto phones the registry; for offline/CI pin explicit p/... packs.
Custom rules go in .semgrep.yml — but prefer registry packs first (YAGNI).
Pairs with the security-review skill: semgrep catches known patterns, the review reasons about the rest.