Semgrep tooling
PenKit51 — Open-source AI penetration testing platform with 63 deep exploitation skills, multi-agent orchestration, PoC-validated findings, and native assistant skills for Claude, ChatGPT, and Grok. Authorized testing only.
npx -y skills add xAmirHamza77/PenKit51 --skill semgrep-toolingAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Exact Semgrep CLI structure, metrics-off scanning, scoped ruleset selection, and automation-safe output patterns.
SKILL.md
7.8 KB, as published. Nobody here has run it
Semgrep Tooling
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Deep Exploitation Guide
Semgrep CLI Playbook
Official docs:
- https://semgrep.dev/docs/cli-reference
- https://semgrep.dev/docs/getting-started/cli
- https://semgrep.dev/docs/semgrep-code/semgrep-pro-engine-intro
Canonical syntax:
semgrep scan [flags]
High-signal flags:
--config <rule_or_ruleset>ruleset, registry pack, local rule file, or directory--metrics=offdisable telemetry and metrics reporting--jsonJSON output--sarifSARIF output--output <file>write findings to file--severity <level>filter by severity--errorreturn non-zero exit when findings exist--quietsuppress progress noise--jobs <n>parallel workers--timeout <seconds>per-file timeout--exclude <pattern>exclude path pattern--include <pattern>include path pattern--exclude-rule <rule_id>suppress specific rule--baseline-commit <sha>only report findings introduced after baseline--proenable Pro engine if available--oss-onlyforce OSS engine only
Agent-safe baseline for automation:
semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet --jobs 4 --timeout 20 /workspace
Common patterns:
- Default security scan:
semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet /workspace - High-severity focused pass:
semgrep scan --config p/default --severity ERROR --metrics=off --json --output semgrep_high.json --quiet /workspace - OWASP-oriented scan:
semgrep scan --config p/owasp-top-ten --metrics=off --sarif --output semgrep.sarif --quiet /workspace - Language- or framework-specific rules:
semgrep scan --config p/python --config p/secrets --metrics=off --json --output semgrep_python.json --quiet /workspace - Scoped directory scan:
semgrep scan --config p/default --metrics=off --json --output semgrep_api.json --quiet /workspace/services/api - Pro engine check or run:
semgrep scan --config p/default --pro --metrics=off --json --output semgrep_pro.json --quiet /workspace
Critical correctness rules:
- Always include
--metrics=off; Semgrep sends telemetry by default. - Always provide an explicit
--config; do not rely on vague or implied defaults. - Prefer
--json --output <file>or--sarif --output <file>for machine-readable downstream processing. - Keep the target path explicit; use an absolute or clearly scoped workspace path instead of
.when possible. - If Pro availability matters, check it explicitly with a bounded command before assuming cross-file analysis exists.
Usage rules:
- Start with
p/defaultunless the task clearly calls for a narrower pack. - Add focused packs such as
p/secrets,p/python, orp/javascriptonly when they match the target stack. - Use
--quietin automation to reduce noisy logs. - Use
--jobsand--timeoutexplicitly for reproducible runtime behavior. - Do not use
-h/--helpfor routine operation unless absolutely necessary.
Failure recovery:
- If scans are too slow, narrow the target path and reduce the active rulesets before changing engine settings.
- If scans time out, increase
--timeoutmodestly or lower--jobs. - If output is too broad, scope
--config, add--severity, or exclude known irrelevant paths. - If Pro mode fails, rerun with
--oss-onlyor without--proand note the loss of cross-file coverage.
If uncertain, query web_search with:
site:semgrep.dev semgrep <flag> cli
Platform Methodology
Semgrep Tooling
penkit51 AI — professional penetration testing skill pack. Authorized testing only.
Deep Exploitation Guide
Semgrep CLI Playbook
Official docs:
- https://semgrep.dev/docs/cli-reference
- https://semgrep.dev/docs/getting-started/cli
- https://semgrep.dev/docs/semgrep-code/semgrep-pro-engine-intro
Canonical syntax:
semgrep scan [flags]
High-signal flags:
--config <rule_or_ruleset>ruleset, registry pack, local rule file, or directory--metrics=offdisable telemetry and metrics reporting--jsonJSON output--sarifSARIF output--output <file>write findings to file--severity <level>filter by severity--errorreturn non-zero exit when findings exist--quietsuppress progress noise--jobs <n>parallel workers--timeout <seconds>per-file timeout--exclude <pattern>exclude path pattern--include <pattern>include path pattern--exclude-rule <rule_id>suppress specific rule--baseline-commit <sha>only report findings introduced after baseline--proenable Pro engine if available--oss-onlyforce OSS engine only
Agent-safe baseline for automation:
semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet --jobs 4 --timeout 20 /workspace
Common patterns:
- Default security scan:
semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet /workspace - High-severity focused pass:
semgrep scan --config p/default --severity ERROR --metrics=off --json --output semgrep_high.json --quiet /workspace - OWASP-oriented scan:
semgrep scan --config p/owasp-top-ten --metrics=off --sarif --output semgrep.sarif --quiet /workspace - Language- or framework-specific rules:
semgrep scan --config p/python --config p/secrets --metrics=off --json --output semgrep_python.json --quiet /workspace - Scoped directory scan:
semgrep scan --config p/default --metrics=off --json --output semgrep_api.json --quiet /workspace/services/api - Pro engine check or run:
semgrep scan --config p/default --pro --metrics=off --json --output semgrep_pro.json --quiet /workspace
Critical correctness rules:
- Always include
--metrics=off; Semgrep sends telemetry by default. - Always provide an explicit
--config; do not rely on vague or implied defaults. - Prefer
--json --output <file>or--sarif --output <file>for machine-readable downstream processing. - Keep the target path explicit; use an absolute or clearly scoped workspace path instead of
.when possible. - If Pro availability matters, check it explicitly with a bounded command before assuming cross-file analysis exists.
Usage rules:
- Start with
p/defaultunless the task clearly calls for a narrower pack. - Add focused packs such as
p/secrets,p/python, orp/javascriptonly when they match the target stack. - Use
--quietin automation to reduce noisy logs. - Use
--jobsand--timeoutexplicitly for reproducible runtime behavior. - Do not use
-h/--helpfor routine operation unless absolutely necessary.
Failure recovery:
- If scans are too slow, narrow the target path and reduce the active rulesets before changing engine settings.
- If scans time out, increase
--timeoutmodestly or lower--jobs. - If output is too broad, scope
--config, add--severity, or exclude known irrelevant paths. - If Pro mode fails, rerun with
--oss-onlyor without--proand note the loss of cross-file coverage.
If uncertain, query web_search with:
site:semgrep.dev semgrep <flag> cli
Validation & Reporting
- Confirm every finding with reproducible PoC before reporting
- Document: severity (CVSS), affected asset, steps, evidence, remediation
- Use
record_vulnerabilitywhen running inside the penkit51 platform - Chain low-severity findings into higher-impact attack paths
- Never report without evidence — distinguish hypothesis from confirmed vuln
Validation & Reporting
- Confirm every finding with reproducible PoC before reporting
- Document: severity (CVSS), affected asset, steps, evidence, remediation
- Use
record_vulnerabilitywhen running inside the penkit51 platform - Chain low-severity findings into higher-impact attack paths
- Never report without evidence — distinguish hypothesis from confirmed vuln