semgrep-appsec-scanner

name	semgrep-appsec-scanner
description	用于通过 Semgrep 执行应用安全 SAST、源码扫描、自定义规则、密钥流程和供应链依赖分析。
zh_description	用于通过 Semgrep 执行应用安全 SAST、源码扫描、自定义规则、密钥流程和供应链依赖分析。
version	1.0.0
author	seaworld008
source	in-house
source_url
tags	[security, sast, semgrep, code-scanning, supply-chain, secrets, ci, appsec]
created_at	2026-05-20
updated_at	2026-05-20
quality	4
complexity	advanced

Semgrep AppSec Scanner

Trigger / When to Use

Use this skill when the user asks for source-code vulnerability scanning, secure coding rule enforcement, custom SAST checks, secret scanning workflow design, or Semgrep Supply Chain dependency analysis.

Good trigger phrases:

• "scan this code with Semgrep"
• "find injection bugs"
• "add SAST to CI"
• "write a Semgrep rule"
• "scan dependencies with Semgrep Supply Chain"
• "triage Semgrep findings"

Core Capabilities

• Run SAST checks across many common programming languages.
• Use community and organization rules from the Semgrep registry.
• Author custom rules for project-specific insecure patterns.
• Triage findings with file, line, rule ID, and dataflow context.
• Integrate scans into pull requests and CI.
• Combine SAST with supply-chain and secrets workflows when the Semgrep plan supports them.

Workflow

1. Identify Languages and Frameworks

Before scanning, inspect the repo:

rg --files | sed -n '1,120p'

Classify:

• Primary languages.
• Web frameworks.
• Package managers and lockfiles.
• Generated directories to exclude.
• Test fixtures that may intentionally contain insecure samples.

2. Verify Semgrep

semgrep --version

If missing, recommend official installation. For one-off local scans, a package manager or containerized Semgrep run is usually enough.

3. Run Baseline SAST

semgrep scan --config auto

For stricter security-focused scans:

semgrep scan --config p/security-audit
semgrep scan --config p/owasp-top-ten

For JSON output:

semgrep scan --config auto --json --output semgrep-results.json

For SARIF:

semgrep scan --config auto --sarif --output semgrep-results.sarif

4. Triage Findings

For each finding, record:

• Rule ID.
• File and line.
• Vulnerability class.
• Source and sink, if dataflow is available.
• User-controlled input evidence.
• Exploit preconditions.
• Suggested fix and regression test.