semgrep

This skill orchestrates high-performance static analysis audits using Semgrep, designed specifically for complex, multi-language codebases. It automates the entire lifecycle of a security scan—from environment detection and Semgrep Pro verification to parallelized execution and result aggregation. The tool is built to integrate seamlessly into AI-assisted security workflows, ensuring that static analysis is both thorough and safe by strictly enforcing telemetry disabling and requiring human-in-the-loop approval before task spawning.

• Automatically detects languages and checks for Semgrep Pro availability to enable advanced cross-file taint analysis and inter-procedural security checks.

• Supports two primary scan modes: 'run all' for comprehensive coverage across all rulesets and 'important only' for focused, high-confidence security vulnerability detection.

• Implements parallel execution by spawning multiple Task subagents for different language components, significantly reducing scan duration on large projects.

• Handles output management, including creating distinct directories, logging approved rulesets, and merging scan results into standardized SARIF output files for easy review.

• Enforces strict security hygiene, such as disabling telemetry (--metrics=off) to prevent data leakage and requiring explicit user authorization for scan plans to ensure controlled, intentional auditing.

• Intended for security engineers, auditors, and developers performing first-pass static analysis, vulnerability research, or security code reviews.

• Requires the Semgrep CLI installed in the environment; optional Semgrep Pro license is recommended for maximum vulnerability detection efficacy.

• Operates as a multi-step orchestration: Step 1 (Detection), Step 2 (Mode selection), Step 3 (Hard gate approval), Step 4 (Parallel execution), and Step 5 (Result merging).

• Users should avoid this skill for binary analysis or when custom rule creation is required (use semgrep-rule-creator instead).

• Default output is directed to a versioned folder (static_analysis_semgrep_N) unless an output directory is specified in the prompt.

• Use this for security audits, finding known bug patterns, and ensuring code quality before pull request reviews.