semgrep: Claude Code Skill & Agent Tool
An open-source skill by trailofbits (opens in a new tab), published in the trailofbits/skills (opens in a new tab) repository on GitHub. Trail of Bits' Semgrep workflow: detects your languages, selects rulesets, asks for approval, then runs the scans and merges the results into SARIF — with cross-file taint analysis when Semgrep Pro is available.
Install semgrep
Requires Node.jsnpx skills add trailofbits/skills --skill semgrepRun this command in your project terminal to install this skill for Claude Code.
What this skill does
This semgrep skill is Trail of Bits' workflow for running a Semgrep security scan over a codebase. Rather than firing off a single command, your agent detects the languages in the repository, selects the matching rulesets and presents the plan for your explicit approval before anything runs.
You choose between two scan modes. Run all applies every ruleset at every severity for full coverage. Important only filters twice — on the command line by severity, then on each rule's metadata — to keep only security findings with medium-to-high confidence and impact, so the report stays actionable. The approved rulesets run in parallel batches through a bundled script, and the results are merged into a single SARIF file that code-scanning tools understand.
When Semgrep Pro is available, the skill uses it for cross-file taint analysis that follows data from source to sink; otherwise it says clearly that it ran the open-source engine. Semgrep metrics are switched off on every command, and results go to a dedicated output directory. Use it with Claude Code for a security audit, bug hunting or static analysis before a release.
Key Capabilities
- Detects your languages and selects the matching Semgrep rulesets
- Presents the scan plan for your approval before running anything
- Run all, or Important only: security findings with medium-to-high confidence and impact
- Parallel scans merged into one SARIF file
- Cross-file taint analysis with Semgrep Pro; metrics always off
How to use with Claude Code & AI Agents
Install the skill
Run the command above at the root of your project. The CLI asks which agents to set up — Claude Code, Cursor and other supported agents — and adds semgrep to the project, so teammates who pull the repository get it too. Add-gto install it for your user account across every project.Open a new agent session
Start a fresh Claude Code session in that project so the agent loads the new skill. Have ready: Semgrep installed (Semgrep Pro optional).Ask in plain words
Describe the task, for example:“Run a Semgrep security scan on this repository, important findings only.”The agent matches your request to the skill's description and follows its SKILL.md instructions step by step. Read them on GitHub before using the skill on a system that matters.