semgrep
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the 'semgrep' command-line tool via well-known package managers (pip, Homebrew) or Docker. These references point to the official, well-known utility provided by the vendor.
- [COMMAND_EXECUTION]: The skill is designed to execute 'semgrep' commands to perform static analysis on codebases. This includes running predefined rulesets (e.g., p/security-audit) and testing custom YAML rules developed by the user.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code as input for its scanning operations.
- Ingestion points: Code files and directories provided by the user for scanning (e.g., 'semgrep --config auto .').
- Boundary markers: None explicitly defined in the skill instructions; the tool processes the entire content of targeted files.
- Capability inventory: Subprocess execution of the 'semgrep' binary which performs file system read operations.
- Sanitization: Relies on the Semgrep static analysis engine's internal parsing logic to analyze code without executing the target source files.
Audit Metadata