Semgrep Skills
Official Semgrep agent skills for secure coding across 15+ languages.
About
Semgrep Skills is the official agent-skills repository from Semgrep, the code-security company. It is beta-level software generated by transforming Semgrep's open-source security rules into the Agent Skills (SKILL.md) format, installable with npx skills add semgrep/skills.
The headline skill, code-security, distills comprehensive secure-coding guidance from Semgrep Engineering: OWASP Top 10 coverage, infrastructure security, and secure coding practices across 15+ languages, including SQL injection, XSS, SSRF, hardcoded secrets, and insecure cryptography.
No explicit open-source license is declared on the repo (NOASSERTION in GitHub metadata), so treat the license as unverified and check before redistributing; use inside your own agent workflows is the intended pattern.
What it can do
- OWASP Top 10 secure-coding guidance
- 15+ language coverage
- Infrastructure security (Terraform, Kubernetes, Docker)
- Hardcoded-secret and crypto hygiene rules
- Code review security checklists
Setup
npx skills add semgrep/skills in a project with a supported coding agent.
Prerequisites
A coding agent that supports the Agent Skills format.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 87; Trending score 70/100 from researcher assessment.
★ 325 GitHub stars
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.