Run Semgrep static analysis for fast security scanning and pattern matching. Use when asked to scan code with Semgrep, write custom YAML rules, find vulnerabilities quickly, use taint mode, or set up Semgrep in CI/CD pipelines.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Run Semgrep static analysis for fast security scanning and pattern matching. Use when asked to scan code with Semgrep, write custom YAML rules, find vulnerabilities quickly, use taint mode, or set up Semgrep in CI/CD pipelines.
allowed-tools
["Bash","Read","Glob","Grep"]
Semgrep Static Analysis
When to Use Semgrep
Ideal scenarios:
Quick security scans (minutes, not hours)
Pattern-based vulnerability detection
Enforcing coding standards and best practices
Finding known vulnerability patterns (OWASP Top 10, CWE Top 25)
Intra-file taint analysis and data flow tracking
Custom rule development for specific code patterns
First-pass security analysis before deeper tools
CI/CD security gates for fast feedback
Multi-language security scanning
Complements other tools:
Use before manual code review to catch common patterns
Combine with SARIF Issue Reporter for detailed findings
Use alongside CodeQL for comprehensive coverage
Pair with dependency scanners (OSV-Scanner, Depscan)
Consider CodeQL instead when:
Need interprocedural taint tracking across files
Complex data flow analysis across modules required
Analyzing custom proprietary frameworks with deep integration
When NOT to Use
Do NOT use this skill for:
Complex interprocedural data flow analysis (use CodeQL instead)
Binary analysis or compiled code without source
Custom deep semantic analysis requiring AST/CFG traversal
Tracking taint across many function boundaries and files
Secrets detection (use Gitleaks)
Dependency vulnerability scanning (use OSV-Scanner or Depscan)
# Pattern `os.system($CMD)` catches this:
os.system(user_input) # Found
But misses indirect flows:
# Same pattern misses this:
cmd = user_input
processed = cmd.strip()
os.system(processed) # Missed - no direct match
Taint mode tracks data through assignments and transformations:
Source: Where untrusted data enters (user_input)
Propagators: How it flows (cmd = ..., processed = ...)
Sanitizers: What makes it safe (shlex.quote())
Sink: Where it becomes dangerous (os.system())
rules:-id:command-injectionlanguages: [python]
message:"User input flows to command execution"severity:ERRORmode:taintpattern-sources:-pattern:request.args.get(...)-pattern:request.form[...]-pattern:request.jsonpattern-sinks:-pattern:os.system($SINK)-pattern:subprocess.call($SINK,shell=True)-pattern:subprocess.run($SINK,shell=True,...)pattern-sanitizers:-pattern:shlex.quote(...)-pattern:int(...)
Full Rule with Metadata
rules:-id:flask-sql-injectionlanguages: [python]
message:"SQL injection: user input flows to query without parameterization"severity:ERRORmetadata:cwe:"CWE-89: SQL Injection"owasp:"A03:2021 - Injection"confidence:HIGHmode:taintpattern-sources:-pattern:request.args.get(...)-pattern:request.form[...]-pattern:request.jsonpattern-sinks:-pattern:cursor.execute($QUERY)-pattern:db.execute($QUERY)pattern-sanitizers:-pattern:int(...)fix:cursor.execute($QUERY,(params,))
Testing Rules
Test File Format
# test_rule.pydeftest_vulnerable():
user_input = request.args.get("id")
# ruleid: flask-sql-injection
cursor.execute("SELECT * FROM users WHERE id = " + user_input)
deftest_safe():
user_input = request.args.get("id")
# ok: flask-sql-injection
cursor.execute("SELECT * FROM users WHERE id = ?", (user_input,))
semgrep --test rules/
CI/CD Integration (GitHub Actions)
name:Semgrepon:push:branches: [main]
pull_request:schedule:-cron:'0 0 1 * *'# Monthlyjobs:semgrep:runs-on:ubuntu-latestcontainer:image:returntocorp/semgrepsteps:-uses:actions/checkout@v4with:fetch-depth:0# Required for diff-aware scanning-name:RunSemgreprun:|
if [ "${{ github.event_name }}" = "pull_request" ]; then
semgrep ci --baseline-commit ${{ github.event.pull_request.base.sha }}
else
semgrep ci
fi
env:SEMGREP_RULES:>-
p/security-audit
p/owasp-top-ten
p/trailofbits
rules:-id:context-aware-xsslanguages: [javascript]
message:"XSS: User input flows to innerHTML"severity:ERRORmode:taintpattern-sources:-pattern:req.query.$PARAMpattern-propagators:-pattern:$X.toString()from:$Xto:$X.toString()-pattern:`${$X}`from:$Xto:`${$X}`pattern-sinks:-pattern:$ELEMENT.innerHTML=$DATApattern-sanitizers:-pattern:DOMPurify.sanitize($X)
Focus Metavariables
rules:-id:sql-injection-advancedlanguages: [python]
message:"SQL injection via string formatting"severity:ERRORpattern:|
$CURSOR.execute($QUERY)
focus-metavariable:$QUERYmetavariable-regex:metavariable:$QUERYregex:.*(\+|format|%).*
Performance Optimization
# Limit to specific file types
semgrep scan --include='*.py' --include='*.js' .
# Increase timeout for large files
semgrep scan --timeout 60 .
# Use baseline for faster incremental scans
semgrep scan --baseline-commit HEAD~1 .
# Parallel processing (default uses all CPUs)
semgrep scan --jobs 4 .
# Disable expensive rules
semgrep scan --config p/security-audit --exclude-rule 'expensive-rule-id' .
