semgrep
Automated security scanner using Semgrep for multi-language vulnerability detection and static analysis.
Install
npx skills add https://github.com/trailofbits/skills --skill semgrepStats
| Total installs | 1,536 |
| Weekly installs | 1.5K |
| GitHub stars | 4.0K |
| First seen | Jan 19, 2026 |
| Source | @trailofbits/skills |
Summary
- Supports two scan modes: "run all" (complete ruleset coverage) and "important only" (high-confidence security vulnerabilities filtered by severity and impact)
- Automatically detects Semgrep Pro availability for cross-file taint analysis; falls back to OSS mode with per-file scanning
- Includes third-party rulesets from Trail of Bits, 0xdea, and Decurity alongside official rules to catch vulnerabilities absent from the default registry
- Spawns parallel scanner subagents for multi-language codebases; merges all results into a single SARIF file with severity and category breakdown
- Requires explicit user approval of the scan plan (languages, rulesets, mode, target directory) before execution begins
Tags
Related skills
| Skill | Installs | vs semgrep |
|---|---|---|
| security-reviewer | 1,336 | -200 |
| xiaohongshu-note-analyzer | 1,730 | +194 |
| clawhub-skill-vetting | 1,350 | -186 |
| secure-workflow-guide | 1,363 | -173 |
| council | 1,523 | -13 |
FAQ
- How many installs does semgrep have?
- semgrep has 1,536 total installs and 1.5K installs this week.
- Where is semgrep hosted?
- semgrep is published by @trailofbits/skills at https://github.com/trailofbits/skills.
- How many GitHub stars does semgrep have?
- semgrep has 4.0K GitHub stars.
- When was semgrep first indexed?
- OrangeBot.AI first indexed semgrep on Jan 19, 2026.
- How do I install semgrep?
- Run: npx skills add https://github.com/trailofbits/skills --skill semgrep