# Audit Code with Semgrep

Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.

## Install

```bash
npx skillstore add agentsecops/sast-semgrep
```

## Metadata

- Status: approved
- Slug: agentsecops-sast-semgrep
- Version: 0.1.0
- Author version: 0.1.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: fd309bcf76f6e336acbc173e5a41a15bad654590d02dc9bd3dfea58dc84e46f1
- Author: AgentSecOps
- GitHub username: AgentSecOps
- License: MIT
- Repository: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/sast-semgrep
- Ref: 9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access, filesystem, scripts
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/agentsecops-sast-semgrep
- Manifest: https://skillstore.pages.dev/api/skills/agentsecops-sast-semgrep/manifest

## Capabilities

- Provides Semgrep commands for baseline, differential, and targeted security scans.
- Maps common findings to OWASP Top 10 and CWE categories.
- Supplies GitHub Actions, GitLab CI, and Jenkins integration examples.
- Provides a YAML template for custom Semgrep security rules.
- Explains remediation patterns for injection, XSS, deserialization, cryptography, SSRF, and XXE.

## Use Cases

- Review a pull request: Scan changed code, validate findings in context, and identify verified issues that should block merging.
- Add a CI security gate: Adapt a pipeline example to publish findings, preserve useful artifacts, and enforce justified severity thresholds.
- Create organization rules: Build and test custom Semgrep rules for unsafe patterns specific to an application or engineering standard.

## Prompt Templates

### Run a baseline scan

```
Identify this repository's languages. Run a Semgrep baseline scan, then summarize high-confidence findings by severity, file, CWE, and recommended fix.
```

### Review changed code

```
Scan changes against [base branch] with Semgrep. Separate new findings from existing debt and explain which findings should block the pull request.
```

### Create a custom rule

```
Create and test a Semgrep rule for [unsafe pattern] in [language]. Include positive and negative fixtures, metadata, and false-positive controls.
```

### Design a CI security gate

```
Design a Semgrep CI gate for [platform]. Pin dependencies, scan changed code, publish SARIF, protect secrets, and define justified failure thresholds.
```

## Limitations

- The documented scanning scripts are not included in the packaged files.
- It does not perform dynamic testing or runtime exploitation validation.
- It does not replace dedicated dependency or secret scanning.
- Results depend on selected rulesets, language support, and local configuration.

## Best Practices

- Review every finding in context before blocking a change.
- Pin CI actions, container images, packages, and rulesets to trusted immutable versions.
- Test custom rules with vulnerable and safe fixtures before deployment.

## Anti Patterns

- Do not treat every Semgrep match as a confirmed vulnerability.
- Do not expose source excerpts, secrets, or unrestricted artifacts in shared reports.
- Do not suppress findings without documented technical justification and an expiration review.

## Security Audit

- Audited at: 2026-07-23T06:41:06.811\+00:00
- Summary: All 109 static findings are false positives from documentation, detection rules, or fixed CI commands; none execute as part of the skill. The audit found flawed SSRF and path-containment guidance, plus unpinned CI dependencies that create supply-chain exposure.

## Stats

- Views: 228
- Downloads: 16
- Favorites: 0
- Popularity score: 0