semgrep-secret-scan
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
semgrep ci --secretsvia shell scripts (scripts/run-secret-scan.sh) to perform the intended security scan. These commands are standard for the tool's usage. - [DATA_EXPOSURE]: The skill requires a
SEMGREP_APP_TOKENfor authentication. The documentation correctly advises users to store this in environment variables or CI/CD secrets rather than hardcoding it, which aligns with security best practices. - [EXTERNAL_DOWNLOADS]: The skill interacts with
https://semgrep.dev, which is the official domain for Semgrep, a well-known and trusted security service. The preflight script usescurlto verify connectivity to this domain.
Audit Metadata