Menu
Run Semgrep security and code quality analysis
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | semgrep |
| description | Run Semgrep security and code quality analysis |
| triggers | ["semgrep","security scan","sast scan","vulnerability scan","code security","security audit"] |
| requires_binary | ["semgrep"] |
Run Semgrep to detect security vulnerabilities and code quality issues in the codebase.
# Auto-detect rules for the project's languages
semgrep scan --config auto --json --quiet 2>/dev/null | head -c 50000
If JSON output is too large, use text output:
semgrep scan --config auto --quiet 2>/dev/null
# Security-focused rules only
semgrep scan --config "p/security-audit" --json --quiet
# OWASP Top 10
semgrep scan --config "p/owasp-top-ten" --json --quiet
# Language-specific
semgrep scan --config "p/golang" --json --quiet
semgrep scan --config "p/python" --json --quiet
semgrep scan --config "p/typescript" --json --quiet
For each finding:
# nosemgrep inline comment with justification# Scan only changed files
semgrep scan --config auto --json --quiet -- path/to/file.py
--severity ERROR to focus on critical issues first--config auto instead of multiple rule packs to avoid re-scanningsemgrep registry# nosemgrep: rule-id with a comment explaining whyExplore codebase structure, entry points, tech stack, hotspots, and call graphs
Search code symbols, find function calls, and analyze codebase
Run the instinct parser catalogue against this session's observe events to surface candidate patterns for promotion to memories. Two-pass: gather candidates, judge intent, write proposals.
Parallel agents with SDLC pipeline per story
Inspect a running swarm — show the agent tree, current tools, halts/pauses, and recent task/message activity for the orchestrator's own swarm.
Systematic debugging workflow for tracking down bugs and issues