semgrep-analyze

Testing & Quality

Run Semgrep static analysis on target files and return structured findings. Use this when the user wants static analysis, SAST scanning, or security scanning — phrases like "run semgrep", "scan for vulnerabilities", "static analysis on this code", or as a pre-review gate when security findings are needed before AI agents run.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/bdfinst/agentic-dev-team/blob/HEAD/plugins/dev-team/skills/semgrep-analyze/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/semgrep-analyze, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Semgrep Analyze

Role: worker. This skill runs Semgrep and reports findings — it does not fix code.

You have been invoked with the /semgrep-analyze skill. Run a Semgrep scan and return structured findings.

Constraints

Do not modify code. Report findings only.
Return structured JSON. Output must match the output format below.
Be concise. No preambles, narration, or filler text.

Parse Arguments

Arguments: $ARGUMENTS

path: Directory or file to scan (default: current working directory)
--rules <ruleset>: Semgrep ruleset (default: auto)
--programmatic: Return structured JSON only, with no prose or status messages. Designed for callers like the static analysis pre-pass in /code-review. When set, skip installation guidance on failure — just return the skip status JSON.

Examples:

/semgrep-analyze
/semgrep-analyze src/
/semgrep-analyze --rules p/security-audit
/semgrep-analyze src/utils --rules p/javascript
/semgrep-analyze --programmatic src/

Steps

1. Check Semgrep installation

semgrep --version

If not installed, output:

{"status": "skip", "issues": [], "summary": "semgrep not installed — install via pip install semgrep, pipx install semgrep, or brew install semgrep"}

If --programmatic is set, return the JSON above and stop — do not add installation guidance or prose.

Otherwise (human-facing run), also tell the user: Run /project-init to set up this repo's tooling as the one-stop entry point — it installs semgrep as a capability tool (see its ${CLAUDE_PLUGIN_ROOT}/skills/project-init/references/capability-tools.md) — or install semgrep directly — pip install semgrep (also pipx install semgrep or brew install semgrep). (The direct install command is the fallback.)

Stop.

2. Run Semgrep scan

semgrep scan --config <ruleset> --quiet --json <path>

Default ruleset is auto. Default path is ..

3. Parse results

Map each Semgrep finding to an issue:

Semgrep field	Output field
`check_id`	`ruleId`
`extra.severity`	`severity`
`path`	`file`
`start.line`	`line`
`extra.message`	`message`
`extra.metadata.cwe`	`cwe` (if present)

Severity mapping:

Semgrep severity	Output severity
ERROR	error
WARNING	warning
INFO	suggestion

4. Output JSON

{
  "status": "pass|warn|fail",
  "issues": [
    {
      "severity": "error|warning|suggestion",
      "file": "<path>",
      "line": 0,
      "ruleId": "<check_id>",
      "message": "<description>",
      "cwe": "<CWE-ID>",
      "suggestedFix": "<fix>"
    }
  ],
  "summary": "<N findings: N errors, N warnings, N suggestions>"
}

Status: fail if any errors, warn if warnings but no errors, pass if clean.

Common Rulesets

Ruleset	Description
`auto`	Auto-detect language, use recommended rules
`p/javascript`	JavaScript-specific rules
`p/typescript`	TypeScript-specific rules
`p/react`	React-specific rules
`p/nodejs`	Node.js security rules
`p/security-audit`	General security audit
`p/owasp-top-ten`	OWASP Top 10 vulnerabilities
`p/ci`	Rules suitable for CI/CD
`p/default`	Semgrep default ruleset