Updated 3mo ago
by semgrep
skills
A collection of skills for AI coding agents from Semgrep
339 GitHub stars (339)
+19 in 30 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | +1 |
| Oct 3 | +1 |
| Oct 4 | +1 |
| Oct 5 | +1 |
| Oct 6 | 0 |
| Oct 7 | +1 |
| Oct 8 | +1 |
| Oct 9 | 0 |
| Oct 10 | +1 |
| Oct 11 | +1 |
| Oct 12 | 0 |
| Oct 13 | +1 |
| Oct 14 | 0 |
| Oct 15 | +2 |
| Oct 16 | +1 |
| Oct 17 | 0 |
| Oct 18 | 0 |
| Oct 19 | 0 |
| Oct 20 | +2 |
| Oct 21 | 0 |
| Oct 22 | 0 |
| Oct 23 | 0 |
| Oct 24 | 0 |
| Oct 25 | +1 |
| Oct 26 | +1 |
| Oct 27 | 0 |
| Oct 28 | 0 |
| Oct 29 | +1 |
| Oct 30 | +2 |
| Oct 31 | +1 |
| Nov 1 | 0 |
| Nov 2 | +1 |
| Nov 3 | +1 |
| Nov 4 | 0 |
| Nov 5 | +1 |
- 3 skills (3 skills found in its SKILL.md files)
- 34 forks (34 forks)
- 3mo ago last update (Last updated 3mo ago)
Install
Skills CLI
npx skills add semgrep/skills
Asks which skills and agents to install. Just one: npx skills add semgrep/skills --skill code-security — add -g for every project.
Claude Code
git clone https://github.com/semgrep/skillscp -r "skills/skills/code-security" ~/.claude/skills/
Copies the code-security skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add semgrep/skills
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
code-security
Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure conf…
skills/code-security/ on GitHub (opens in a new tab)SKILL.md -
llm-security
Security guidelines for LLM applications based on OWASP Top 10 for LLM 2025. Use when building LLM apps, reviewing AI security, implementing RAG systems, or asking about LLM vulnerabilities like 'prompt injection' or 'check LLM security'. IMPORTANT: Always consult this skill when building chatbots, AI agents, RAG pipelines, tool-using LLMs, agentic systems, or any application that calls an LLM AP…
skills/llm-security/ on GitHub (opens in a new tab)SKILL.md -
semgrep
Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use this skill when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', 'static analysis', 'lint for security', 'audit this code', or want to enforce coding st…
skills/semgrep/ on GitHub (opens in a new tab)SKILL.md
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.