Semgrep Skills
Three Semgrep skills for Claude Code and Cursor: secure coding by OWASP, LLM application security, and running Semgrep with custom rules
- 340 ★ on the repository
- Last commit
Extended access
Why this level
- The semgrep skill runs the scanner on the command line and reads project sources
- With a Semgrep AppSec Platform token the agent pulls findings from the cloud platform
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/semgrep-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The semgrep skill runs the scanner on the command line and reads project sources
- With a Semgrep AppSec Platform token the agent pulls findings from the cloud platform
This is third-party code. Review the repository files before installing.
What it does
The Semgrep repository holds three skills in the Agent Skills format. The code-security skill turns open Semgrep rules into secure coding guidance: SQL and command injection, XSS, XXE, path traversal, hardcoded secrets, weak cryptography, SSRF, JWT, plus Terraform, Kubernetes, Docker and GitHub Actions settings. Coverage is stated for more than 15 languages. The llm-security skill follows the OWASP Top 10 for LLM applications 2025: prompt injection, sensitive information disclosure, excessive agency, system prompt leakage, weaknesses in vector stores. The semgrep skill guides the agent through running scans with `semgrep --config auto` or curated rulesets and through writing custom rules. A new rule starts from tests: examples marked `ruleid:` and `ok:` first, then the rule, until the tests pass. If Semgrep MCP tools exist in the environment, the skill prefers them and otherwise falls back to the command line.
Who it is for. Developers and security engineers who review code with Claude Code or Cursor and want Semgrep rules behind the answers instead of model memory.
Good fit when
- Before merging a branch the agent has to review the changes for SQL injection, XSS and hardcoded secrets
- A team writes its own Semgrep rule for a banned call and wants tests first
- An application calls an LLM and needs a list of OWASP LLM Top 10 defenses for prompts and RAG
- Terraform or Kubernetes manifests are checked for public buckets, root privileges and unpinned images
- Semgrep goes into CI and should scan only the changed lines
Not a fit when
- You need a ready report from the Semgrep platform without running the scanner: the skills do not replace the platform
- The task is bug hunting with dynamic testing or fuzzing
- The project uses a language outside the Semgrep list and no fitting rules exist
- You need certainty that the code is fully safe: the authors call these skills beta
Example request
Review this React component for security issues and write a Semgrep rule that catches hardcoded API keys in PythonLimitations
- The authors call the skills beta: they were mostly produced by transforming open Semgrep rules.
- Scanning needs Semgrep installed on the machine or its MCP tools connected; the skills do not install the scanner.
- Some functions, such as fetching findings from the Semgrep AppSec Platform, need a platform account and token.
- GitHub detects no license automatically (NOASSERTION), so read the LICENSE file for the terms.
How to disable. Delete the code-security, llm-security and semgrep folders from the agent skills directory, for example `~/.claude/skills/`. Semgrep itself stays untouched.
FAQ
How do I install Semgrep Skills in Claude Code?
Run `npx skills add semgrep/skills` in a terminal. The command copies the three skills into the skills directory of the chosen agent.
Does it need Semgrep installed?
For scanning, yes: the semgrep skill calls `semgrep --config auto` or Semgrep MCP tools. The other two skills work as references and need no scanner.
How is code-security different from the Semgrep scanner?
The skill gives the agent secure coding rules so it writes and reviews code by them. The scanner matches patterns in finished files. Together they cover both steps.
What does llm-security cover?
The ten OWASP categories for LLM applications 2025, from prompt injection to unbounded consumption. Each has defenses, such as input validation and least privilege.
Can I write custom rules with the skill?
Yes. The semgrep skill sets the order: describe the vulnerability, write tests marked `ruleid:` and `ok:`, inspect the parse tree with `semgrep --dump-ast`, then write the rule.
Discussion
No questions or reviews yet.
Related
SkillsStatic code analysis with rules that look like source code, plus a built-in MCP server for AI agents
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A skill for reviewing code for vulnerabilities against OWASP Top 10:2025, ASVS 5.0 and the 2026 lists for LLM and AI agent security
Semia is a skill-auditing CLI that reads instructions as data without executing the commands in the skill under review.
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Semgrep Skills (this card) | yes | 340 | ||
| Semgrep | yes | not required | 17,471 | the Semgrep engine itself, while this repository holds agent skills on top of it |
| Trail of Bits Skills Curated | yes | 525 | a security audit skill selection from another team, not built on Semgrep rules |
README in short
The README presents the collection as a beta in the Agent Skills format and describes each of the three skills: when to use it, which categories it covers and when taint mode applies. Below are sample prompts, build commands through `make` and the skill structure with `rules/`, `scripts/` and `references/` folders.
README badge
Original SKILL.md
---
name: semgrep
description: "Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use this skill when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', 'static analysis', 'lint for security', 'audit this code', or want to enforce coding standards — even if they don't mention Semgrep by name. Semgrep is the right tool for pattern-based code scanning across 30+ languages."
---
# Semgrep Static Analysis
Fast, pattern-based static analysis for security scanning and custom rule creation.
## MCP Tools Available
If Semgrep MCP tools are available in your environment, prefer them for scanning:
- **`semgrep_scan`** — Scan code files for security vulnerabilities using built-in rulesets. Pass absolute file paths and an optional config (e.g., `p/security-audit`, `auto`).
- **`semgrep_scan_with_custom_rule`** — Scan code with a custom YAML rule you've written. Pass code content inline along with the rule.
- **`semgrep_findings`** — Fetch existing findings from the Semgrep AppSec Platform for a repository.
- **`semgrep_rule_schema`** — Get the full schema for writing Semgrep rules.
- **`get_supported_languages`** — List all languages Semgrep supports.
When MCP tools aren't available, fall back to the CLI commands below.
## When to Use Semgrep
**Ideal scenarios:**
- Quick security scans (minutes, not hours)
- Pattern-based bug and vulnerability detection
- Enforcing coding standards and best practices
- Finding known vulnerability patterns (OWASP, CWE)
- Creating custom detection rules for your codebase
- Data flow analysis with taint mode
## Installation (CLI)
```bash
# pip (recommended)
python3 -m pip install semgrep
# Homebrew
brew install semgrep
# Docker
docker run --rm -v "${PWD}:/src" semgrep/semgrep semgrep --config auto /src
```
---
# Part 1: Running Scans
## Quick Scan
```bash
semgrep --config auto . # Auto-detect rules
```
## Using Rulesets
```bash
semgrep --config p/<RULESET> . # Single ruleset
semgrep --config p/security-audit --config p/trailofbits . # Multiple
```