agentsclimarketplace

Semgrep tooling

Skill xAmirHamza77/PenKit51/skills/semgrep-tooling

PenKit51 — Open-source AI penetration testing platform with 63 deep exploitation skills, multi-agent orchestration, PoC-validated findings, and native assistant skills for Claude, ChatGPT, and Grok. Authorized testing only.

Install
npx -y skills add xAmirHamza77/PenKit51 --skill semgrep-tooling

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Exact Semgrep CLI structure, metrics-off scanning, scoped ruleset selection, and automation-safe output patterns.

SKILL.md

7.8 KB, as published. Nobody here has run it

Semgrep Tooling

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Semgrep CLI Playbook

Official docs:

Canonical syntax: semgrep scan [flags]

High-signal flags:

  • --config <rule_or_ruleset> ruleset, registry pack, local rule file, or directory
  • --metrics=off disable telemetry and metrics reporting
  • --json JSON output
  • --sarif SARIF output
  • --output <file> write findings to file
  • --severity <level> filter by severity
  • --error return non-zero exit when findings exist
  • --quiet suppress progress noise
  • --jobs <n> parallel workers
  • --timeout <seconds> per-file timeout
  • --exclude <pattern> exclude path pattern
  • --include <pattern> include path pattern
  • --exclude-rule <rule_id> suppress specific rule
  • --baseline-commit <sha> only report findings introduced after baseline
  • --pro enable Pro engine if available
  • --oss-only force OSS engine only

Agent-safe baseline for automation: semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet --jobs 4 --timeout 20 /workspace

Common patterns:

  • Default security scan: semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet /workspace
  • High-severity focused pass: semgrep scan --config p/default --severity ERROR --metrics=off --json --output semgrep_high.json --quiet /workspace
  • OWASP-oriented scan: semgrep scan --config p/owasp-top-ten --metrics=off --sarif --output semgrep.sarif --quiet /workspace
  • Language- or framework-specific rules: semgrep scan --config p/python --config p/secrets --metrics=off --json --output semgrep_python.json --quiet /workspace
  • Scoped directory scan: semgrep scan --config p/default --metrics=off --json --output semgrep_api.json --quiet /workspace/services/api
  • Pro engine check or run: semgrep scan --config p/default --pro --metrics=off --json --output semgrep_pro.json --quiet /workspace

Critical correctness rules:

  • Always include --metrics=off; Semgrep sends telemetry by default.
  • Always provide an explicit --config; do not rely on vague or implied defaults.
  • Prefer --json --output <file> or --sarif --output <file> for machine-readable downstream processing.
  • Keep the target path explicit; use an absolute or clearly scoped workspace path instead of . when possible.
  • If Pro availability matters, check it explicitly with a bounded command before assuming cross-file analysis exists.

Usage rules:

  • Start with p/default unless the task clearly calls for a narrower pack.
  • Add focused packs such as p/secrets, p/python, or p/javascript only when they match the target stack.
  • Use --quiet in automation to reduce noisy logs.
  • Use --jobs and --timeout explicitly for reproducible runtime behavior.
  • Do not use -h/--help for routine operation unless absolutely necessary.

Failure recovery:

  • If scans are too slow, narrow the target path and reduce the active rulesets before changing engine settings.
  • If scans time out, increase --timeout modestly or lower --jobs.
  • If output is too broad, scope --config, add --severity, or exclude known irrelevant paths.
  • If Pro mode fails, rerun with --oss-only or without --pro and note the loss of cross-file coverage.

If uncertain, query web_search with: site:semgrep.dev semgrep <flag> cli

Platform Methodology

Semgrep Tooling

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Semgrep CLI Playbook

Official docs:

Canonical syntax: semgrep scan [flags]

High-signal flags:

  • --config <rule_or_ruleset> ruleset, registry pack, local rule file, or directory
  • --metrics=off disable telemetry and metrics reporting
  • --json JSON output
  • --sarif SARIF output
  • --output <file> write findings to file
  • --severity <level> filter by severity
  • --error return non-zero exit when findings exist
  • --quiet suppress progress noise
  • --jobs <n> parallel workers
  • --timeout <seconds> per-file timeout
  • --exclude <pattern> exclude path pattern
  • --include <pattern> include path pattern
  • --exclude-rule <rule_id> suppress specific rule
  • --baseline-commit <sha> only report findings introduced after baseline
  • --pro enable Pro engine if available
  • --oss-only force OSS engine only

Agent-safe baseline for automation: semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet --jobs 4 --timeout 20 /workspace

Common patterns:

  • Default security scan: semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet /workspace
  • High-severity focused pass: semgrep scan --config p/default --severity ERROR --metrics=off --json --output semgrep_high.json --quiet /workspace
  • OWASP-oriented scan: semgrep scan --config p/owasp-top-ten --metrics=off --sarif --output semgrep.sarif --quiet /workspace
  • Language- or framework-specific rules: semgrep scan --config p/python --config p/secrets --metrics=off --json --output semgrep_python.json --quiet /workspace
  • Scoped directory scan: semgrep scan --config p/default --metrics=off --json --output semgrep_api.json --quiet /workspace/services/api
  • Pro engine check or run: semgrep scan --config p/default --pro --metrics=off --json --output semgrep_pro.json --quiet /workspace

Critical correctness rules:

  • Always include --metrics=off; Semgrep sends telemetry by default.
  • Always provide an explicit --config; do not rely on vague or implied defaults.
  • Prefer --json --output <file> or --sarif --output <file> for machine-readable downstream processing.
  • Keep the target path explicit; use an absolute or clearly scoped workspace path instead of . when possible.
  • If Pro availability matters, check it explicitly with a bounded command before assuming cross-file analysis exists.

Usage rules:

  • Start with p/default unless the task clearly calls for a narrower pack.
  • Add focused packs such as p/secrets, p/python, or p/javascript only when they match the target stack.
  • Use --quiet in automation to reduce noisy logs.
  • Use --jobs and --timeout explicitly for reproducible runtime behavior.
  • Do not use -h/--help for routine operation unless absolutely necessary.

Failure recovery:

  • If scans are too slow, narrow the target path and reduce the active rulesets before changing engine settings.
  • If scans time out, increase --timeout modestly or lower --jobs.
  • If output is too broad, scope --config, add --severity, or exclude known irrelevant paths.
  • If Pro mode fails, rerun with --oss-only or without --pro and note the loss of cross-file coverage.

If uncertain, query web_search with: site:semgrep.dev semgrep <flag> cli

Validation & Reporting

  • Confirm every finding with reproducible PoC before reporting
  • Document: severity (CVSS), affected asset, steps, evidence, remediation
  • Use record_vulnerability when running inside the penkit51 platform
  • Chain low-severity findings into higher-impact attack paths
  • Never report without evidence — distinguish hypothesis from confirmed vuln

Validation & Reporting

  • Confirm every finding with reproducible PoC before reporting
  • Document: severity (CVSS), affected asset, steps, evidence, remediation
  • Use record_vulnerability when running inside the penkit51 platform
  • Chain low-severity findings into higher-impact attack paths
  • Never report without evidence — distinguish hypothesis from confirmed vuln

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.