Semgrep
Run Semgrep static analysis scan on a codebase using parallel subagents.
Install
npx skills add vigolium/vigolium --skill semgrep -g -a claude-code -y- Repository
- vigolium/vigolium1.1k
- Category
- Security
- Updated
- 10d ago
- License
- See repository
- Context cost
- Mediumabout 2,272 tokens
- Runs scripts
- Yes, review before use
What it does
Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes, "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases.
Semgrep Security Scan
Run a Semgrep scan with automatic language detection, parallel execution via Task subagents, and merged SARIF output.
Essential Principles
- Always use
--metrics=off, Semgrep sends telemetry by default;--config autoalso phones home. Everysemgrepcommand must include--metrics=offto prevent data leakage during security audits. - User must approve the scan plan (Step 3 is a hard gate), The original "scan this codebase" request is NOT approval. Present exact rulesets, target, engine, and mode; wait for explicit "yes"/"proceed" before spawning scanners.
- Third-party rulesets are required, not optional, Trail of Bits, 0xdea, and Decurity rules catch vulnerabilities absent from the official registry. Include them whenever the detected language matches.
- Spawn all scan Tasks in a single message, Parallel execution is the core performance advantage. Never spawn Tasks sequentially; always emit all Task tool calls in one response.
- Always check for Semgrep Pro before scanning, Pro enables cross-file taint tracking and catches ~250% more true positives. Skipping the check means silently missing critical inter-file vulnerabilities.
When to Use
- Security audit of a codebase
- Finding vulnerabilities before code review
- Scanning for known bug patterns
- First-pass static analysis
When NOT to Use
- Binary analysis → Use binary analysis tools
- Already have Semgrep CI configured → Use existing pipeline
- Need cross-file analysis but no Pro license → Consider CodeQL as alternative
- Creating custom Semgrep rules → Use
semgrep-rule-creatorskill - Porting existing rules to other languages → Use
semgrep-rule-variant-creatorskill
Output Directory
All scan results, SARIF files, and temporary data are stored in a single output directory.
