Semgrep Skills - Setup Guide¶

Source: semgrep/skills via skills.sh - 6.6K combined installs across 3 indexed listings; first documented 2026-11-02 (evening sweep)

GitHub: semgrep/skills - 338 stars, LICENSE file present but GitHub reports the license as NOASSERTION because the text is the Semgrep Rules License v1.0, branch main, last pushed 2026-07-28; 3 skills under skills/ (code-security, llm-security, semgrep), each with a SKILL.md and a rules/ folder of Markdown rule pages, a zipped copy beside each folder, a TypeScript build pipeline in packages/skill-build and a Makefile

Category: Application security for coding agents: secure coding rules across 15+ languages, Semgrep scanning and custom rule authoring, and OWASP Top 10 for LLM applications

Quality Tier: 🟡 Yellow - two of three sampled listings carry an auditor Warn and the repository is not under an open source license, even though all three skills pass the Gen Agent Trust Hub check

The repository is Semgrep Engineering's packaging work rather than a library: the README is titled "Agent Skills [Beta]" and says plainly that the content is "primarily generated by transforming open-source Semgrep rules into skill format". Three skills come out of that pipeline, and they are three different jobs wearing one name. code-security is a routing index over 28 rule pages covering OWASP Top 10, infrastructure and language-specific pitfalls. llm-security is the same shape applied to the OWASP Top 10 for LLM Applications 2025. semgrep is the operational one: how to run scans, which rulesets to use, how to write a rule, and how to test it.

The build side is unusual for a skill repository and worth reading. packages/skill-build holds TypeScript sources (build.ts, parser.ts, sections.ts, validate.ts, extract-tests.ts) that assemble rule Markdown into a SKILL.md, plus per-skill test case files (test-cases-code-security.json, test-cases-llm-security.json) used as validation fixtures. The Makefile exposes validate, build, zip and install, which is why every skill folder has a .zip twin beside it.

Installation¶

The README documents one install path, and it is the generic CLI:

npx skills add semgrep/skills

There is no documented manual install, so the folder copy below is the equivalent operation. Copy whole skill folders, because the rule pages are the content and a SKILL.md alone is an index with nothing behind it:

git clone --depth 1 https://github.com/semgrep/skills.git /tmp/semgrep-skills
mkdir -p ~/.hermes/profiles/corpusiq/skills/semgrep-suite
cp -R /tmp/semgrep-skills/skills/code-security ~/.hermes/profiles/corpusiq/skills/semgrep-suite/
cp -R /tmp/semgrep-skills/skills/llm-security ~/.hermes/profiles/corpusiq/skills/semgrep-suite/
cp -R /tmp/semgrep-skills/skills/semgrep ~/.hermes/profiles/corpusiq/skills/semgrep-suite/

The scanning skill drives the Semgrep CLI, which is a separate install and is documented inside skills/semgrep/SKILL.md:

python3 -m pip install semgrep

Homebrew and Docker variants are listed alongside it, and the skill prefers Semgrep MCP tools (semgrep_scan, semgrep_scan_with_custom_rule, semgrep_findings, semgrep_rule_schema, get_supported_languages) when the agent has them connected, falling back to the CLI when it does not.

What It Provides¶

Skill	Installs	Use For
code-security	2,693	The secure coding index: 28 rule pages grouped by impact, from SQL injection, command injection, XSS, XXE, path traversal and insecure deserialization through crypto, transport, SSRF, JWT, CSRF and prototype pollution, then Terraform on AWS, Azure and GCP, Kubernetes, Docker and GitHub Actions, down to regex DoS, race conditions and maintainability. It opens with a per-language priority table so the agent checks the rules that matter for Python, JavaScript, Java, Go, C/C++, Ruby, PHP or HCL first.
semgrep	2,255	Running and authoring scans: `--config auto`, named rulesets such as `p/security-audit`, `p/owasp-top-ten`, `p/cwe-top-25` and `p/trailofbits`, SARIF and JSON output, path targeting, `.semgrepignore`, `nosemgrep` suppression, choosing taint mode over pattern matching, the rule syntax operators (`pattern-either`, `pattern-not-inside`, `metavariable-regex`), and the mandatory test-first step with annotated test files.
llm-security	1,674	LLM application review against the OWASP Top 10 for LLM Applications 2025: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. It routes by what is being built (chatbot, RAG, tool-using agent, fine-tune, API, content generation) before listing rules.

All 3 indexed listings clear the threshold and appear in the table above.

The split between index and content is deliberate and it is the thing to understand before installing. code-security/SKILL.md is 82 lines and llm-security/SKILL.md is 80, while the substance lives in rules/*.md files with vulnerable and secure examples per language. semgrep/SKILL.md is 321 lines and self-contained, because it is teaching a tool rather than cataloguing categories. code-security/metadata.json records the provenance: version 0.1.0, organisation Semgrep Engineering, dated January 2026, abstract "Comprehensive code security guide, designed for AI agents and LLMs".

Why This Matters for Hermes Agents¶

Most agents write plausible code with predictable security holes, and the holes cluster: string-concatenated SQL, eval on request data, subprocess with shell=True, path joins with user input, MD5 for passwords. code-security is a lookup table for exactly those clusters, organised by language, which is a better shape than a general "write secure code" paragraph because it gives the agent somewhere specific to go.

The semgrep skill closes the loop that review-only skills leave open. Reading rules changes what the agent writes; running a scan proves it. Taint mode is the part worth internalising, and the skill says why in one line: pattern matching alone cannot tell eval(user_input) from eval("safe_literal"), and prioritising taint mode is the difference between a rule that fires on the real bug and one that fires on every call site.

The LLM rules are the least commoditised content here. Agents building RAG pipelines or tool-using systems routinely produce code with no tenant isolation on the vector store, no output encoding on model responses, and tool permissions far beyond the task. llm-security maps each of those to a numbered OWASP category and a rule file, and it asks what is being built first, so a chatbot review does not open with fine-tuning guidance.

The build pipeline adds something agents rarely get: the rules are generated from Semgrep's own rule corpus and validated against test case files, so the content has a reproducible origin instead of being hand-written advice. That also explains the failure mode to watch for, since generated content inherits the shape of its source, and the README's own "beta" label is honest about it.

Usage¶

You say	What happens
"Scan this repo for security problems"	`semgrep` runs `--config p/security-audit`, or calls `semgrep_scan` if the MCP tools are connected, then groups findings by severity and rule.
"Review this pull request for vulnerabilities"	`code-security` identifies the language and what the code touches, checks the critical and high rules first, then reads the matching rule files before commenting.
"Write a rule that catches user input reaching os.system"	`semgrep` picks taint mode, declares `request.args.get` sources and `os.system` sinks with `shlex.quote` as a sanitizer, then writes an annotated test file before the rule is trusted.
"Is my RAG pipeline secure?"	`llm-security` routes to the RAG row, which points at vector and embedding weaknesses, prompt injection, sensitive disclosure and misinformation.
"Wire this scan into CI"	`semgrep` produces the SARIF invocation (`--sarif -o results.sarif`) and the `.semgrepignore` entries for vendor, generated and test fixture paths.
"This finding is a false positive"	`semgrep` applies a `nosemgrep` comment scoped to the rule id rather than disabling the ruleset.
"Review this Terraform for public buckets"	`code-security` goes to the Terraform AWS rule page rather than the general injection rules, since the risk is configuration, not data flow.

Verification¶

The raw path below returned 200 on branch main on 2026-11-02:

curl -sL -o /dev/null -w "%{http_code}\n" \
  https://raw.githubusercontent.com/semgrep/skills/main/skills/semgrep/SKILL.md

After a clone, confirm the rule pages arrived, because the index skills are useless without them:

git clone --depth 1 https://github.com/semgrep/skills.git /tmp/semgrep-skills
find /tmp/semgrep-skills -name SKILL.md | wc -l
ls /tmp/semgrep-skills/skills/code-security/rules | wc -l
ls /tmp/semgrep-skills/skills/llm-security/rules | wc -l
head -3 /tmp/semgrep-skills/skills/semgrep/SKILL.md

The first count prints 3, the second 30 files in the code-security rules folder (28 rule pages plus _sections.md and _template.md), the third 11 in llm-security, and head shows name: semgrep. Confirm the installed copy and the CLI:

ls ~/.hermes/profiles/corpusiq/skills/semgrep-suite/code-security/rules | wc -l
semgrep --version

Security¶

skills.sh verdicts for sampled skills (verified 2026-11-02) - re-check the security pages on skills.sh before production use:

Skill	Gen Agent Trust Hub	Socket	Snyk
code-security	Pass	Warn	Pass
semgrep	Pass	Pass	Pass
llm-security	Pass	Pass	Warn

The skill folders contain no executable code. They are Markdown rule pages, three SKILL.md files, a metadata.json and prebuilt .zip archives. What does execute is the Semgrep CLI, which the agent will install and run over your source tree, so the meaningful trust decision is about the scanner and the ruleset names it is told to use rather than about the skill text.

The licensing is the sharper issue. LICENSE contains the Semgrep Rules License v1.0, which is why GitHub reports NOASSERTION and why this is not an open source license in the OSI sense. Installing the skill into your own agent is one thing; republishing the rule text, or shipping it inside a product, is governed by that license rather than by an expectation set by MIT-licensed neighbours in the catalog.

The two Warns sit on the skill that encourages autonomous code review and on the one that covers AI systems, neither of which executes anything itself. Treat findings as leads, and read skills/semgrep/SKILL.md before letting an agent run scans unattended on a large tree, since --config auto chooses rules by name rather than from a pinned local file.

Integration with CorpusIQ¶

CorpusIQ is the connector layer that lets AI assistants read the systems a business already runs on - accounting, payments, CRM, email, files and analytics - and answer with the source named. It is read-only by design: it retrieves data and never writes to, or acts in, a connected system, which is what makes it safe to point at live accounts.

This page is part of the CorpusIQ directory, the reference we maintain for the MCP server and agent-skill ecosystem. Run alongside CorpusIQ, a third-party server like this one can be combined with a company's own business data in a single answer.

See what CorpusIQ connects

Limitations¶

Snapshot data, verified 2026-11-02: 6,622 combined installs across 3 indexed listings; 338 GitHub stars; Semgrep Rules License v1.0 (GitHub reports NOASSERTION); last pushed 2026-07-28. Counts drift over time.
The README labels the whole repository beta and states the skills are primarily generated by transforming open source Semgrep rules. Generated guidance inherits the gaps of the rule corpus it came from.
The license is not an open source license. Redistribution and embedding terms come from the Semgrep Rules License v1.0, not from an OSI-approved text, and there is no separate permission file for the narrative parts.
The two index skills are thin by design: 82 and 80 lines pointing into 28 and 11 rule pages. An agent that loads only SKILL.md gets categories and no examples.
Every skill folder is duplicated as a .zip beside it, so a clone is roughly twice the size of the content and an agent browsing the tree sees each skill twice.
code-security/metadata.json still reads version 0.1.0 dated January 2026 while the repository was pushed in July 2026, so the version field is not a reliable statement about the content.
Coverage is rule categories, not a scan engine. There is no scheduled scanning, no baseline or triage workflow and no findings store in the repository; that lives in the Semgrep platform.

Skills Catalog | Skills Marketplace

Pro Tips¶

Load the rule page, not the index. Asking for "the SQL injection guidance" should land on rules/sql-injection.md, where the vulnerable and secure examples live, instead of the category list in SKILL.md.
Make the agent write the test file first. The semgrep skill calls test-first mandatory and uses annotated test files, which is also the fastest way to discover that a rule matches nothing.
Prefer taint mode for anything described as injection. The skill states the reason directly, and pattern-only rules will either miss the bug or flood the review.
Keep .semgrepignore current before the first CI run. vendor, node_modules and generated paths produce the noise that gets security scans switched off in week two.
Ask for the OWASP category alongside the finding. llm-security is numbered from LLM01 to LLM10, and the number is what makes a review comment actionable for whoever fixes it.

← Skills Catalog | Skills Marketplace → Powered by CorpusIQ