Install
$ npx skills add semgrep/skillsNeeds the semgrep CLI: brew install semgrep (or python3 -m pip install semgrep). Prefers Semgrep MCP tools when present, otherwise falls back to the CLI.
Best for
Pattern-based vulnerability scanning across a polyglot codebase, and writing custom YAML rules to enforce a house convention the linter cannot express.
Not ideal for
Teams that need a permissive licence. This ships under the Semgrep Rules License v1.0, not MIT or Apache — read it before vendoring the rules into a commercial product.
About this skill
Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. Also use when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', 'static analysis', 'lint for security', 'audit this code', or want to enforce coding standards — even if they don't mention Semgrep by name. Semgrep is the right tool for pattern-based code scanning across 30+ languages.
Score breakdown
Score breakdown
rubric 1.0Composite 0–100 score derived from 9 verifiable signals. See the rubric →
Related skills
Security audits run by a real security firm. CodeQL + Semgrep + audit workflows.
Kubernetes hardening by the book. NetworkPolicies, RBAC, OPA, service mesh.
Real exploits, no false positives. 96.15% exploit success across 50+ vuln types.
