Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "sast-semgrep" from https://skillstore.io/skills/agentsecops-sast-semgrep.md and its manifest at https://skillstore.io/api/skills/agentsecops-sast-semgrep/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "sast-semgrep". Review this Python service for SQL injection.
Expected outcome:
Using "sast-semgrep". Add Semgrep to this pull request workflow.
Expected outcome:
All 109 static findings are false positives from documentation, detection rules, or fixed CI commands; none execute as part of the skill. The audit found flawed SSRF and path-containment guidance, plus unpinned CI dependencies that create supply-chain exposure.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-sast-semgrep/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-sast-semgrep?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-sast-semgrep?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-sast-semgrep/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-sast-semgrep.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). sast-semgrep security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-sast-semgrep/audits/10@techreport{agentsecops-agentsecops-sast-semgrep-2026,
author = {AgentSecOps},
title = {sast-semgrep security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/agentsecops-sast-semgrep/audits/10},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sast-semgrep security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-sast-semgrep/audits/10"
identifiers:
- type: other
value: "skillstore:agentsecops-sast-semgrep:audit:10"
description: "Skillstore immutable audit report identifier"
Scan changed code, validate findings in context, and identify verified issues that should block merging.
Adapt a pipeline example to publish findings, preserve useful artifacts, and enforce justified severity thresholds.
Build and test custom Semgrep rules for unsafe patterns specific to an application or engineering standard.
Identify this repository's languages. Run a Semgrep baseline scan, then summarize high-confidence findings by severity, file, CWE, and recommended fix.
Scan changes against [base branch] with Semgrep. Separate new findings from existing debt and explain which findings should block the pull request.
Create and test a Semgrep rule for [unsafe pattern] in [language]. Include positive and negative fixtures, metadata, and false-positive controls.
Design a Semgrep CI gate for [platform]. Pin dependencies, scan changed code, publish SARIF, protect secrets, and define justified failure thresholds.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Ref
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Maintenance freshness
7/24/2026
Usage
11 downloads · 227 views
File structure
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Scan Python Code with Bandit
Python security flaws can reach production unnoticed. This skill guides Bandit scans, prioritization, CI integration, and remediation with CWE and OWASP references.
Scan Code for Security Vulnerabilities
by sickn33
Teams need repeatable source code security checks before release. This skill helps configure SAST tools, triage findings, and map fixes to secure coding patterns.
Configure SAST for DevSecOps Pipelines
by wshobson
Teams need repeatable security scans before code reaches production. This skill guides SAST setup, rule tuning, and CI gate configuration.
Review Application Security Risks
by Bikach
Security reviews can miss issues across authentication, input handling, APIs, and secrets. This skill provides structured guidance, checklists, and remediation patterns for application-security work.
Audit Applications with an OWASP Security Checklist
by ArieGoldkin
Security reviews can miss common vulnerabilities and inconsistent controls. This skill provides structured OWASP checks, secure examples, and scanning workflows for repeatable assessments.
Audit Python Web Apps Before Release
by glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Run OWASP Web Security Testing
by sickn33
Web teams need a repeatable way to check common application risks before release. This skill organizes OWASP testing into phases, prompts, and reporting steps.