semgrep
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads Semgrep rulesets from external GitHub repositories, including security research organizations such as Trail of Bits, 0xdea, and Atlassian Labs. These rulesets provide specialized vulnerability detection patterns for various languages and frameworks.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage the analysis environment, including
gitfor cloning rulesets,semgrepfor performing the scan, andjqfor merging and filtering results. - [DATA_EXFILTRATION]: The skill includes explicit instructions to use the
--metrics=offflag in all Semgrep commands. This prevents the default behavior of the Semgrep CLI, which involves sending telemetry and potentially sensitive data to external servers during scans. - [PROMPT_INJECTION]: A mandatory "Hard Gate" is implemented in the workflow (Step 3), requiring the agent to present the exact scan plan (including rulesets and targets) and receive explicit user approval before executing any scanning tools.
Audit Metadata