semgrep
semgrep is an agent skill published by semgrep, listed under review & testing. It lives in the semgrep/skills repository, which has 332 GitHub stars and is licensed under NOASSERTION; we last read it on 2026-09-16.
Run static analysis scans and create custom detection rules using Semgrep. Connects to code to find security vulnerabilities and enforce coding standards across 30+ languages.
Install
skills is a generic installer for any repository of Claude agent skills -- it reads semgrep/skills’s own structure rather than assuming one, the same way this page reads the skill’s own SKILL.md rather than assuming a format.
npx skills add semgrep/skills
Maintenance
Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use this skill when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', 'static analysis', 'lint for security', 'audit this code', or want to enforce coding standards — even if they don't mention Semgrep by name. Semgrep is the right tool for pattern-based code scanning across 30+ languages.
semgrep compared with similar skills
| Skill | Publisher | What it does | Repo stars | Last update |
|---|---|---|---|---|
| semgrep (this page) | semgrep | Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep… | 332 | 2026-07-28 |
| code-security(same repository) | semgrep | Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or as… | 332 | 2026-07-28 |
| code-review | mattpocock | Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does t… | 303,549 | 2026-10-22 |
| scaffold-exercises | mattpocock | Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Us… | 303,549 | 2026-10-22 |
| tdd | mattpocock | Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-gree… | 303,549 | 2026-10-22 |
| webapp-testing | anthropic | Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend… | 183,845 | 2026-10-09 |
| browser-testing-with-devtools | addyosmani | Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browse… | 110,611 | 2026-10-13 |
Skills from the same repository first, then others for this job by repository stars. Figures are from each repository when we last read it.
Common questions about semgrep
- What does semgrep do?
- Run static analysis scans and create custom detection rules using Semgrep. Connects to code to find security vulnerabilities and enforce coding standards across 30+ languages.
- How do I install semgrep?
- Run npx skills add semgrep/skills. The skills installer reads the repository’s own structure, so it works for any repository of agent skills.
- Who publishes semgrep?
- semgrep.
- Is semgrep maintained, and what licence does it use?
- Its repository has 332 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-07-28. The repository declares the NOASSERTION licence.
More agent skills for review & testing
- browser-testing-with-devtoolsby addyosmani
- code-review-and-qualityby addyosmani
- code-simplificationby addyosmani
- doubt-driven-developmentby addyosmani
- vitestby antfu
- webapp-testingby anthropic