SubmitLog in
c/security › command
0votes

Semgrep security scan (Trail of Bits)

Skill
submitted by u/client to c/security · 0 uses

Runs a planned, approved Semgrep scan of a codebase and merges results into SARIF.

Claude detects the languages in a repo, picks suitable Semgrep rulesets and shows you the scan plan for approval before running anything. Bundled scripts run the rulesets in batches and merge the output into SARIF. You can choose full coverage or only medium-to-high-confidence security findings, and Semgrep Pro cross-file analysis is used if available. Requires the Semgrep CLI; metrics are turned off.

Try asking:

  • "Scan this repo for security vulnerabilities with Semgrep"
  • "Run only high-confidence Semgrep security rules"
  • "Do a static analysis pass before our audit"

Source: trailofbits/skills · CC-BY-SA-4.0 · by Trail of Bits

0 commentsreport

Install this skill

Skills are folders with a SKILL.md file. Claude loads one on its own when a task matches its description. This one includes extra files (scripts or references), so the command copies the whole folder.

Claude Code plugin (easiest, stays up to date)
/plugin marketplace add trailofbits/skills
/plugin install static-analysis@trailofbits
Claude Code: for every project
npx degit trailofbits/skills/plugins/static-analysis/skills/semgrep ~/.claude/skills/semgrep
Claude Code: this project only (commit it to share with your team)
npx degit trailofbits/skills/plugins/static-analysis/skills/semgrep .claude/skills/semgrep
View SKILL.mdSource

Made by Trail of Bits, CC-BY-SA-4.0 license. Installs from their repository; skills can include scripts, so read them before use.

In the Claude apps, zip the folder and upload it under Settings → Capabilities → Skills.

More from c/security

See all of c/security →
0 comments

Log in to join the discussion.