关于
This skill enables Semgrep static analysis for fast security scanning and pattern matching in code. It helps developers find vulnerabilities, write custom YAML rules, use taint mode analysis, and integrate scanning into CI/CD pipelines. Use it when you need to perform security-focused static code analysis with Semgrep.
快速安装
Claude Code
推荐npx skills add plurigrid/asi -a claude-code/plugin add https://github.com/plurigrid/asigit clone https://github.com/plurigrid/asi.git ~/.claude/skills/semgrep在 Claude Code 中复制并粘贴此命令以安装该技能
GitHub 仓库
Frequently asked questions
What is the semgrep skill?
semgrep is a Claude Skill by plurigrid. Skills package instructions and resources that Claude loads on demand, so Claude can perform semgrep-related tasks without extra prompting.
How do I install semgrep?
Use the install commands on this page: add semgrep to Claude Code as a plugin, or clone its repository into your skills directory, then restart Claude so it picks up the skill.
What category does semgrep belong to?
semgrep is in the static-analysis category, tagged ai and design.
Is semgrep free to use?
Yes. semgrep is listed on AIMCP and free to install. It runs inside Claude, so no separate service account is required to use the skill itself.
相关推荐技能
这个Skill让开发者能直接通过Claude运行Semgrep静态分析工具，快速扫描代码安全漏洞和进行模式匹配。它支持编写自定义YAML规则、使用污点分析模式，并能协助设置CI/CD流水线中的自动化扫描。特别适合需要在开发过程中快速发现安全问题和集成安全扫描的开发者。
该Skill能解析和处理SARIF格式文件，用于读取安全扫描结果、聚合多工具发现并去重告警。它支持提取特定漏洞数据，并能将SARIF数据集成到CI/CD流程中。开发者可用它统一处理静态分析结果，实现安全报告的自动化管理。
这个Skill用于解析和处理SARIF格式的安全扫描结果文件，能够聚合多工具发现、去重告警并提取特定漏洞。它特别适用于将SARIF数据集成到CI/CD流水线中，自动化处理安全扫描结果。开发者可用它来统一分析来自不同静态分析工具的输出，简化安全报告工作流。
这个Skill让开发者能够使用CodeQL进行静态安全分析，包括漏洞检测、污点追踪和数据流分析。它适用于创建CodeQL数据库、编写自定义QL查询、执行安全审计以及在CI/CD流水线中集成CodeQL。由Trail of Bits开发，为代码安全分析提供了专业级的自动化工具。