The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell scripts (preflight.sh and run-sast-scan.sh) to perform environment validation and trigger the Semgrep CLI. These operations are standard for a development tool and are limited to executing the semgrep, git, and curl commands.
[EXTERNAL_DOWNLOADS]: The skill documentation suggests installing the semgrep tool via pip, brew, or docker. These are well-known, trusted installation methods and registries.
[CREDENTIALS_UNSAFE]: The skill correctly manages credentials by instructing users to use environment variables (SEMGREP_APP_TOKEN) or .env files rather than hardcoding secrets. It also includes a masking mechanism in the preflight script when displaying the token for validation.

semgrep-sast-scan