static-analysis

name	static-analysis
description	Security reviews, code quality audits, or when the user mentions CodeQL, Semgrep, or finding vulnerability patterns across a codebase.

Static Analysis

When to activate

Security reviews, code quality audits, or when the user mentions CodeQL, Semgrep, or finding vulnerability patterns across a codebase.

When NOT to use

• Runtime security testing (fuzzing, penetration testing, DAST) — static analysis only covers code paths, not live execution
• Linting for style/formatting — use ESLint, Prettier, Ruff; those are not vulnerability scanners
• Single-file code review without a vulnerability focus — use the code-review skill instead

Instructions

Semgrep

Running against a repo:

# Use managed ruleset (OWASP, CVEs, secrets)
semgrep --config auto .

# Run a specific ruleset
semgrep --config p/owasp-top-ten .

# Run custom rules
semgrep --config ./rules/custom.yaml .

# CI integration — fail on error or warning
semgrep --config auto --error .

Pattern syntax:

• $X — metavariable, matches any expression
• ... — ellipsis, matches zero or more statements or arguments
• (int)$X — typed metavariable (Java/C only)

Writing a custom rule:

rules:
  - id: sql-string-concat
    pattern: |
      $QUERY = "..." + $INPUT
      $DB.execute($QUERY)
     
     
     [, ]