Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF.
Install
npx skills add trailofbits/skills --skill semgrepnpx skills add trailofbits/skills --skill semgrep -a claude-code -gnpx skills add trailofbits/skills --skill semgrep -a codex -ggemini skills install https://github.com/trailofbits/skills.git --path plugins/static-analysis/skills/semgrepgh skill install trailofbits/skills semgrepgit clone --depth 1 https://github.com/trailofbits/skills /tmp/trailofbits__skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/trailofbits__skills/plugins/static-analysis/skills/semgrep ~/.claude/skills/semgrep # Claude Code
cp -R /tmp/trailofbits__skills/plugins/static-analysis/skills/semgrep ~/.agents/skills/semgrep # Codex, Cursor, Gemini CLI, Copilot, OpenCode