RetentaRetenta

Evidence record · captured 2026-10-11

Semgrep Security Scan

Runs a Semgrep security scan end to end: detects languages, selects rulesets, presents the plan for explicit user approval, then executes every approved ruleset through a bundled script (metrics off, batched processes) and merges results into one SARIF file. Supports 'run all' and 'important only' (medium-to-high confidence/impact) modes and uses Semgrep Pro cross-file taint analysis when available.

Community publisherUnverifiedSource reviewedBehavior not tested
Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

Wraps Semgrep in a gated, script-driven workflow: the agent proposes rulesets, waits for explicit approval, and a bundled runner builds every command, so telemetry stays off and failed scans are reported, not hidden.

Best for

  • A first-pass static security audit of a multi-language repository
  • Producing one merged SARIF file for import into a code-scanning tool
  • Audits where you want to see and edit the exact ruleset list before anything runs

Strengths in the source

  • scripts/run-scans.sh generates every semgrep command with --metrics=off and validates third-party ruleset URLs against an https-only pattern.
  • Makes plan approval a hard gate and lists rationalizations to reject, including treating the original scan request as approval.
  • Requires the report to list failed, skipped, partial, oversized and covered-nothing scans from scans.json, so a partial scan is not presented as complete.
  • Adds Trail of Bits, 0xdea and Decurity community rulesets when languages match, and checks for Semgrep Pro cross-file taint analysis before scanning.

Limitations

  • Requires the Semgrep CLI, jq and uv; cross-file analysis needs a Semgrep Pro login, and the run silently falls back to OSS without one.
  • Fetches registry rules and shallow-clones third-party rule repositories at their default branch at run time, so the rules applied are not fixed by this pin.
  • Writes output into a static_analysis_semgrep_N directory inside the target by default, and does not triage or fix findings.

When not to use it

  • Repositories that already run Semgrep in CI, where the existing pipeline is the source of truth
  • Writing custom Semgrep rules or analyzing binaries, which the skill directs elsewhere

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review
  • plugins/static-analysis/skills/semgrep/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

Bundles 3 scripts (scripts/run-scans.sh, scripts/merge_sarif.py, scripts/test_merge_sarif.py) that the agent may run. Retenta has not run them or scanned them.

Revision
442fc9d6c89b1e937e6f7a477e7071ea75fcbea4
License evidence
CC-BY-SA-4.0Retenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change
2026-09-28
Independent verification
Published by Trail of Bits, which does not own the product this skill covers. Not independently verified.
Upstream repository
Open publisher repository

Compatibility

Claude Code (plugin marketplace)

documented

Named in the upstream skill or repository documentation; not tested by Retenta.

OpenAI Codex (agents/openai.yaml bundled)

documented

Named in the upstream skill or repository documentation; not tested by Retenta.

Antigravity

documented

Named in the upstream skill or repository documentation; not tested by Retenta.

Requirements and access

  • Semgrep CLI (optionally Semgrep Pro)
  • bash, jq
  • uv (to run the Python merger)
  • Network access to fetch registry and approved third-party rulesets

Referenced tools

No named tool is required by the reviewed SKILL.md.

Install from the source

Clones the current default branch, which may be newer than the reviewed revision 442fc9d. The destination shown is Claude Code's personal skills folder; other agents read the same folder from their own skills directory.

View the SKILL.md at its source Verify the publisher's install documentation

More Security skills →

Install the full skill folder

git clone --depth 1 https://github.com/trailofbits/skills.git
cp -R skills/plugins/static-analysis/skills/semgrep ~/.claude/skills/semgrep

Thyme RAG Capsules

Make this skill’s state durable, governed, and portable.

A Retenta capsule lets agents recall prior work, append provenance-stamped progress, and carry the memory to the next run.

Create durable agent memoryUnderstand the evidence labels