Skip to content
Agentmart
Submit a tool
This entry duplicates semgrep, which is the one we list in search.

semgrep

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset…

Skill by heisetiantang

IndexedLicense unknown
Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/heisetiantang-semgrep

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.

Use cases: testing, security, productivity

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions: not checked yet.

What's inside

Skill name
semgrep
Description
Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.
License
unknown
Allowed tools
Bash, Read, Glob, AskUserQuestion, TaskCreate, TaskList, TaskUpdate
Instructions
256 lines in SKILL.md · view on GitHub

Before installing

  • Ships executable scripts
  • Pre-approves any shell command

Files (9)

  • SKILL.md
  • openai.yaml · agents/
  • trail-of-bits-mark.svg · assets/
  • rulesets.md · references/
  • scan-modes.md · references/
  • merge_sarif.py · scripts/
  • run-scans.sh · scripts/
  • test_merge_sarif.py · scripts/
  • scan-workflow.md · workflows/

The license isn't open source, so the instructions aren't shown here. Read SKILL.md on GitHub

More from heisetiantang/codex-skills-RE

Signals

Stars
0
Forks
0
Open issues
0
Last commit (this folder)
Sep 28, 2026 (1 month ago)

From GitHub (fetched Oct 24, 2026).

Details

License
License unknown
Repository
github.com/heisetiantang/codex-skills-RE
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

Same skill elsewhere

Copies of this SKILL.md published by others; search shows only one of them.

More from heisetiantang

Cite this page

semgrep skill. Agent Mart. https://agentmart.dev/skills/heisetiantang-semgrep (last updated 2026-10-24)