semgrep/skills: Semgrep's agent skills for code and LLM security

The gap semgrep/skills fills between a scanner and an assistant

Semgrep is a static analysis tool. It reports findings after code exists. An AI coding agent writes code first and asks questions later, so the finding arrives one step too late. This repository tries to move the knowledge upstream: it packages security instructions as Agent Skills, which the README describes as "packaged instructions and scripts that extend agent capabilities", so the agent consults them while writing or reviewing code rather than after a CI run.

The audience is narrow and specific. You need an agent that understands the Agent Skills format, and you need to care about the categories the repository covers: the OWASP Top 10, Terraform on AWS, Azure and GCP, Kubernetes manifests, Dockerfiles, GitHub Actions workflows, and the OWASP Top 10 for LLM Applications 2025. If your work is a Rails monolith with no infrastructure-as-code and no model calls, most of the shipped material will never trigger. The README states the project is "primarily generated by transforming open-source Semgrep rules into skill format", which is the honest description of what you get: a translation layer, not hand-written prose from a security team.

That generation step shapes everything downstream. A Semgrep rule is a pattern with a message attached. Turning it into skill text means the agent receives a statement of what to avoid, without the matched code that would have made the finding concrete. The README does not claim the transformation was reviewed line by line, and it does not describe an evaluation set for the generated instructions. The practical consequence is that the skills read like a checklist written by someone who has seen many vulnerable patterns but not your codebase.

Three skills, one packaging format

The repository ships three skills. code-security covers OWASP Top 10 categories plus infrastructure and cloud configuration across 15 or more languages, listing Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, C/C++, C#, Scala, Kotlin, Rust, HCL and YAML. llm-security maps the OWASP Top 10 for Large Language Model Applications 2025 onto prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption, and names MITRE ATLAS and NIST AI RMF as frameworks. The semgrep skill is the operational one: it tells the agent how to run scans and how to author custom rules.

Each skill directory holds a SKILL.md with the agent instructions, an optional rules/ directory of individual rule files, optional scripts/, and optional references/. The Makefile only validates and builds skills that have a rules/ directory, so a skill consisting of prose alone is packaged but not rule-checked. That distinction matters when you audit what you are installing: the zip step packages any directory containing SKILL.md, while validate and build skip directories without rules/.

The impact table in the README assigns severity levels from Critical down to Low. Nine categories sit at Critical, including SQL injection, command injection, XSS, XXE, path traversal, insecure deserialization, code injection, hardcoded secrets and memory safety. That ordering is useful when you are deciding whether to install the whole skill or trim it: if your stack is Python and Kubernetes, the Terraform and C/C++ material is weight you carry for no benefit.

Installing semgrep/skills and running a first review

The README gives a single install command. It uses the skills CLI through npx and points at the GitHub repository path:

npx skills add semgrep/skills

After that, the README says skills are automatically available and the agent uses them when relevant tasks are detected. There is no registration step and no config file to edit. To confirm the install worked, ask the agent something the code-security skill claims to cover, using the README's own phrasing:

Review this React component for security issues

A working install produces a review that references the skill's categories rather than a generic answer. If the agent responds without mentioning the guidance it loaded, the skill is not being picked up.

The semgrep skill is where the repository becomes actionable rather than advisory. The README documents a rule-authoring workflow: analyse the vulnerability pattern, write test cases first with `ruleid:` and `ok:` annotations, inspect the AST, write the rule, and iterate until the tests pass. The AST inspection step uses this command:

semgrep --dump-ast

For quick scans the README lists `semgrep --config auto` and named rulesets including security-audit, owasp-top-ten, cwe-top-25 and trailofbits. If you want to build the skills from source instead of installing them, the Makefile provides the entry points, and dependency installation runs through pnpm inside packages/skill-build:

make install
make validate
make build
make zip

Single-skill variants exist for the validation and build steps, for example `make validate-skill SKILL=code-security` and `make build-skill SKILL=llm-security`. The default `make` target runs validate, build and zip in sequence.

Where the generated-from-rules approach shows its seams

The README is explicit that this is "beta-level software". No releases were retrieved, so there is no tagged version to pin and no changelog to read before upgrading. The last push to main was on 2026-07-28, which is recent enough that the project is not dormant, but a moving main branch is a different dependency from a released package.

The deeper limitation is the generation pipeline. Transforming Semgrep rules into skill format preserves pattern knowledge but not the surrounding judgement. A rule that matches a dangerous function call is precise; a paragraph of guidance derived from that rule can be read by an agent as a blanket prohibition. The README does not document how conflicts between generated guidance and a project's existing conventions are resolved, and it does not describe an evaluation harness for the generated text. The Makefile's validate target checks rules, not whether the resulting instructions change agent behaviour correctly.

There is also a language boundary. The code-security skill lists 15 or more languages, but the README does not state per-language depth. A team writing Elixir or Swift will find the language list silent on their stack. Finally, the repository declares NOASSERTION for its licence, and the README says nothing about terms of use. For an internal developer tool that is a detail; for redistribution inside a product it is a question for whoever handles licensing.

How the semgrep skill differs from running Semgrep in CI

The obvious alternative is Semgrep itself: run `semgrep --config auto` in a pipeline and triage findings. The approaches solve different problems. A CI scan is deterministic, runs against committed code, and produces a report you can gate a merge on. The semgrep skill instead teaches the agent to invoke scans and, more interestingly, to author rules: the README describes a workflow of analysing the vulnerability pattern, writing test cases first with `ruleid:` and `ok:` annotations, inspecting the AST with `semgrep --dump-ast`, writing the rule, and iterating until the tests pass.

That workflow is the strongest part of the repository, because it produces an artefact you keep. The instructions themselves are the weaker part: they live in the agent's context, are not versioned per project, and cannot be diffed in a pull request the way a ruleset can. If your goal is a merge gate, stay with Semgrep in CI. If your goal is an agent that writes a rule when it spots a pattern your ruleset misses, this is the piece that does not exist elsewhere in the Semgrep toolchain.

A second alternative is writing your own SKILL.md. The format is plain Markdown, and the repository's own structure is the template: instructions in SKILL.md, rules in rules/, helpers in scripts/, supporting documentation in references/. The difference is provenance. Your version encodes your conventions and your false-positive history; Semgrep's version encodes a general corpus and arrives with the beta caveat attached.

Maintenance, upgrades and the licence question

Upgrading means re-running the install command, because there is no release channel to follow. The README documents `make install`, `make validate`, `make build`, `make zip` and `make` for the all-of-the-above case, plus single-skill variants such as `make validate-skill SKILL=code-security` and `make build-skill SKILL=llm-security`. Dependency installation goes through pnpm inside packages/skill-build. The clean target removes generated zips and test-case JSON files.

The cost of maintaining a fork is real but bounded. Skills are Markdown plus rules, so a team that wants to trim the guidance to its own standards can edit SKILL.md files directly and rebuild. The licence field reads NOASSERTION, which means GitHub could not classify the LICENSE file automatically. The README does not restate the terms, so the LICENSE file at the repository root is the only authority here. Read it before you vendor any of this into a product you ship.

What to check before you trust the output

Install the skill, then ask your agent something the code-security skill claims to cover, such as reviewing a React component for XSS or a Terraform S3 block for public access. Confirm the agent cites the skill rather than answering from its own training. Then try the semgrep skill on a rule you already know: ask it to detect hardcoded API keys in Python, as the README's own example does, and check whether the generated rule passes its own test cases.

The failure mode to watch for is confident, generic advice. Because the content is generated from rules, it can read as authoritative while missing your framework's idioms. Treat a skill response as a prompt to run the actual scanner, not as a substitute for it. The README's own rule-creation workflow ends with iterating until 100 percent of tests pass, and that is the standard worth holding the generated output to.

Editorial conclusion

Adopt semgrep/skills if you already run an agent that follows the Agent Skills format and you want Semgrep's rule corpus to surface during code review, especially for SQL injection, XSS and secrets handling. Skip it if you need a stable, versioned dependency: the README calls this beta, no releases were retrieved, and the repository declares no recognised licence, so any commercial use needs a human to check the LICENSE file first. Before relying on it, verify three things in your own checkout: that your agent actually loads the skill, that the code-security skill covers the languages you write, and what the LICENSE file says. The last push to main was on 2026-07-28.

Frequently asked questions

Official sources

1. Issues
2. Project website
3. README
4. semgrep/skills on GitHub