// Analyze code with Semgrep for security vulnerabilities and code quality issues, then create a prioritized fix plan
| name | semgrep-analyze |
| description | Analyze code with Semgrep for security vulnerabilities and code quality issues, then create a prioritized fix plan |
| user-invocable | true |
| allowed-tools | Bash, Read, Write, Grep, Glob |
Analyze code with Semgrep and plan fixes for identified issues.
/semgrep-analyze [path] [--rules <ruleset>]
Arguments:
path - Directory or file to analyze (default: current directory)--rules - Semgrep ruleset to use (default: auto)Examples:
/semgrep-analyze
/semgrep-analyze src/
/semgrep-analyze --rules p/security-audit
/semgrep-analyze src/utils --rules p/javascript
First, verify semgrep is installed:
semgrep --version
If not installed, install via pip (recommended):
# Install semgrep via pip
pip install semgrep
# Or via pipx for isolated environment
pipx install semgrep
# Or via Homebrew on macOS
brew install semgrep
Run semgrep with appropriate rules:
# Auto-detect language and use recommended rules
semgrep scan --config auto .
# Use specific ruleset
semgrep scan --config p/javascript .
semgrep scan --config p/typescript .
semgrep scan --config p/security-audit .
semgrep scan --config p/owasp-top-ten .
# Output as JSON for parsing
semgrep scan --config auto --json -o semgrep-results.json .
# Scan specific directory
semgrep scan --config auto src/
| Ruleset | Description |
|---|---|
auto | Auto-detect language, use recommended rules |
p/javascript | JavaScript-specific rules |
p/typescript | TypeScript-specific rules |
p/react | React-specific rules |
p/nodejs | Node.js security rules |
p/security-audit | General security audit |
p/owasp-top-ten | OWASP Top 10 vulnerabilities |
p/ci | Rules suitable for CI/CD |
p/default | Semgrep default ruleset |
For each finding, document:
For each issue, create a fix plan:
## Issue: [Rule ID]
**Severity:** [ERROR/WARNING/INFO]
**File:** [path:line]
**Problem:**
[Description of the issue]
**Current Code:**
```[language]
[code snippet]
Proposed Fix:
[fixed code]
Rationale: [Why this fix addresses the issue]
### 6. Prioritize Fixes
Order fixes by:
1. **Critical** - Security vulnerabilities, data exposure
2. **High** - Bugs that could cause runtime errors
3. **Medium** - Code quality issues, potential bugs
4. **Low** - Style issues, minor improvements
## Example Workflow
```bash
# 1. Check installation
semgrep --version
# 2. If not installed
pip install semgrep
# 3. Run scan
semgrep scan --config auto --json -o semgrep-results.json .
# 4. View summary
semgrep scan --config auto . 2>&1 | tail -20
# 5. Scan specific areas if needed
semgrep scan --config p/security-audit src/
After analysis, provide:
Create .semgrep.yml for custom rules or to ignore paths:
# .semgrep.yml
rules: []
# Or reference external rules
# rules:
# - p/javascript
# - p/security-audit
# Ignore paths
# paths:
# exclude:
# - node_modules
# - dist
# - "*.test.js"
| Issue | Fix |
|---|---|
| Hardcoded secrets | Move to environment variables |
| SQL injection | Use parameterized queries |
| XSS vulnerability | Sanitize user input |
| Insecure randomness | Use crypto.randomUUID() |
| Issue | Fix |
|---|---|
| Unused variables | Remove or prefix with _ |
| Missing error handling | Add try/catch or error callbacks |
| Deprecated API usage | Update to modern API |
| Inefficient patterns | Refactor to optimal approach |
| Issue | Fix |
|---|---|
| Missing key prop | Add unique key to list items |
| Direct DOM manipulation | Use framework methods |
| Memory leaks | Clean up subscriptions/listeners |
| Unsafe innerHTML | Use safe rendering methods |
After fixing issues:
# Verify fixes
semgrep scan --config auto .
# Run existing quality gates
npm test && npm run build && npm run lint
# Check if pip is available
pip --version
# If pip not found, install Python first
# macOS: brew install python
# Ubuntu: sudo apt install python3-pip
# Then install semgrep
pip install semgrep
# Login to avoid rate limits
semgrep login
# Or use offline mode with local rules
semgrep scan --config ./local-rules.yml .
# Scan specific directories
semgrep scan --config auto src/
# Exclude large directories
semgrep scan --config auto --exclude node_modules --exclude dist .
Implement an approved feature file using ATDD workflow with test-first development
Add a new calculated metric to the VSM dashboard with test-first development
Create a new React component following project conventions with PropTypes and test attributes
Create a new feature file for ATDD workflow - must be done BEFORE any implementation
Add a new type of process step to the VSM builder with custom visualization
Create or run simulation features for analyzing work flow through value streams