Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/Nox-Lumen-tech/combo-skills --skill semgrepThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | semgrep |
| description | 跨语言 SAST 扫描，SQL 注入/XSS/密钥泄露/taint tracking，支持自定义 YAML 规则 |
| execution_mode | sandbox |
| metadata | {"language":["java","kotlin","python","c","cpp","javascript","go","ruby","30+"],"upstream":{"repo":"https://github.com/semgrep/semgrep","stars":14700,"rules_repo":"https://github.com/semgrep/semgrep-rules (1,100 stars)","since":2020,"license":"LGPL-2.1","latest":"v1.157.0 (2026-03)","rules":"2,800+ 社区 / 20,000+ Pro / 600+ 高置信安全规则","languages":"30+","enterprise_usage":"1M+ 周扫描, 100M+ 行/天","notable_users":["Dropbox","Figma","Snowflake","HashiCorp","GitLab"],"mcp_server":"semgrep mcp（官方 MCP Server, AI 助手可直接调用扫描）","scan_speed":"中位 10 秒 CI 扫描","contributors":200,"integrations":["GitHub Actions","GitLab CI","Jenkins","VSCode","IntelliJ","MegaLinter","reviewdog"]},"rating":{"community":"5/5","rules_richness":"5/5","speed":"5/5","accuracy":"4.5/5","integration":"5/5","overall":"4.9/5 ⭐⭐⭐⭐⭐"}} |
| 检查范围 | 对应需求 | Semgrep 规则集 |
|---|---|---|
| SQL 注入 | "SQL注入" | p/java + p/python 内置规则 |
| XSS | "XSS攻击" | p/xss |
| 敏感信息泄露 | "敏感信息泄露" | p/secrets |
| 权限控制 | "权限控制不当" | p/owasp-top-ten |
| 公司自定义规则 | 公司特定检查 | standards-converter 从 KB 生成的 .yaml 规则 |
CLI: semgrep scan --config=auto --config=p/java --config={custom_rules_from_standards_converter}/ --json src/
特点: 支持编写公司自定义规则（YAML），可检测业务特有的安全模式
现有库: pip install semgrep（semgrep/semgrep，15K stars）。原生 JSON/SARIF 输出。重要：Semgrep 已有官方 MCP Server（semgrep mcp），可让 AI 助手直接调扫描，代码在 cli/src/semgrep/mcp/semgrep.py。Docker 运行：docker run --rm -v "${PWD}:/src" semgrep/semgrep semgrep scan --config=auto --json。2800+ 社区规则 + 自定义 YAML 规则。