---
name: semgrep
slug: semgrep-scan
score: 52
rubric: 1.0
provenance: verified-org
publisher: Semgrep
license: Semgrep Rules License v1.0
capability: action-taking
canonical: https://top-agent-skills.com/skill/semgrep-scan
---

# semgrep

Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns.

## Install

### Claude Code

```bash
npx skills add semgrep/skills
```

## Best for

Pattern-based vulnerability scanning across a polyglot codebase, and writing custom YAML rules to enforce a house convention the linter cannot express.

## Not ideal for

Teams that need a permissive licence. This ships under the Semgrep Rules License v1.0, not MIT or Apache — read it before vendoring the rules into a commercial product.

## About

Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. Also use when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', 'static analysis', 'lint for security', 'audit this code', or want to enforce coding standards — even if they don't mention Semgrep by name. Semgrep is the right tool for pattern-based code scanning across 30+ languages.

## Compatibility

claude-code

## Metadata

- Categories: security-auditing, code-quality-review
- Surfaces: claude-code
- Tags: SAST, Semgrep, Static analysis
- Setup time: 3 min
- Complexity: Medium
- Last update: 2026-07-28
- Verified: —
- Source: https://github.com/semgrep/skills/tree/main/skills/semgrep
- Docs: https://github.com/semgrep/skills/blob/main/skills/semgrep/SKILL.md

---

_Indexed by Top Agent Skills. Score breakdown: https://top-agent-skills.com/about/methodology_