# Semgrep

Run Semgrep static analysis scan on a codebase using parallel subagents.

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Security
- License: see repository
- Last updated: 2026-10-25
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add vigolium/vigolium --skill semgrep -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill semgrep -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill semgrep -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill semgrep -g -a gemini-cli -y`

## Description

Run Semgrep static analysis scan on a codebase using parallel subagents. Supports two scan modes, "run all" (full ruleset coverage) and "important only" (high-confidence security vulnerabilities). Automatically detects and uses Semgrep Pro for cross-file taint analysis when available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. Spawns parallel workers for multi-language codebases.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Semgrep Security Scan

Run a Semgrep scan with automatic language detection, parallel execution via Task subagents, and merged SARIF output.

## Essential Principles

1. **Always use `--metrics=off`**, Semgrep sends telemetry by default; `--config auto` also phones home. Every `semgrep` command must include `--metrics=off` to prevent data leakage during security audits.
2. **User must approve the scan plan (Step 3 is a hard gate)**, The original "scan this codebase" request is NOT approval. Present exact rulesets, target, engine, and mode; wait for explicit "yes"/"proceed" before spawning scanners.
3. **Third-party rulesets are required, not optional**, Trail of Bits, 0xdea, and Decurity rules catch vulnerabilities absent from the official registry. Include them whenever the detected language matches.
4. **Spawn all scan Tasks in a single message**, Parallel execution is the core performance advantage. Never spawn Tasks sequentially; always emit all Task tool calls in one response.
5. **Always check for Semgrep Pro before scanning**, Pro enables cross-file taint tracking and catches ~250% more true positives. Skipping the check means silently missing critical inter-file vulnerabilities.

## When to Use

- Security audit of a codebase
- Finding vulnerabilities before code review
- Scanning for known bug patterns
- First-pass static analysis

## When NOT to Use

- Binary analysis → Use binary analysis tools
- Already have Semgrep CI configured → Use existing pipeline
- Need cross-file analysis but no Pro license → Consider CodeQL as alternative
- Creating custom Semgrep rules → Use `semgrep-rule-creator` skill
- Porting existing rules to other languages → Use `semgrep-rule-variant-creator` skill

## Output Directory

All scan results, SARIF files, and temporary data are stored in a single output directory.

The rest: https://github.com/vigolium/vigolium/blob/HEAD/platform/vigolium-audit/src/content/skills/semgrep/SKILL.md