Name: semgrep
Rating: 52.8 (1 reviews)
Author: membranedev

Blog Docs Log in Get started

semgrep

Semgrep integration. Manage Rules, Scans. Use when the user wants to interact with Semgrep data.

Quality

59%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/semgrep/SKILL.md

Quality

Content

56%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with copy-paste Membrane commands and a well-validated connection workflow. Its weaknesses are conciseness (intro padding explaining concepts Claude knows plus an inlined 17-row action table) and progressive disclosure (everything inlined with no reference files to offload the bulk API reference).

Suggestions

Delete the introductory paragraph explaining what Semgrep is and who uses it; Claude already knows this — start directly at how to use the skill.

Move the 17-row 'Popular actions' table into a references file (e.g. references/actions.md) and keep only the 4-5 most common actions inline, linking out for the rest.

Fix the connection workflow numbering (label the 'ensure' step as 1a, add an explicit 'Step 2: Search for actions' heading) so the cross-reference and sequence are unambiguous.

Dimension	Reasoning	Score
Conciseness	The opening paragraph explains what Semgrep is and who uses it ('Semgrep is a static analysis tool for finding bugs... Developers and security engineers use it...') — concepts Claude already knows — and the 17-row popular-actions table inlines bulk API reference, giving 'several unnecessary explanations or padded sections'. It is not 3 (the padding is more than 'some' over-explanation) and not 1 (commands and code are largely efficient rather than severely padded).	2 / 5
Actionability	Concrete, copy-paste-ready commands appear throughout (npm install, membrane login, connection ensure, action list/run, request) plus a proxy-options table and named action keys. It is mostly executable with minor gaps (placeholders like CONNECTION_ID/<actionId>/QUERY need substitution, and there is no single end-to-end worked example), fitting anchor 4 rather than the fully-covered anchor 5.	4 / 5
Workflow Clarity	The connection flow is a clear sequence with explicit validation (READY/BUILDING/CLIENT_ACTION_REQUIRED/CONFIGURATION_ERROR state checks) and a feedback loop ('poll again... to check if the state moved to READY'). It misses a clean 5 because of inconsistent numbering ('#### 1b' with no 1a, a dangling 'Step 2' reference, and no unified connect→search→run numbering).	4 / 5
Progressive Disclosure	Section headers are clear and well-organized, but with no bundle files the entire ~160-line guide is inlined, including a 17-row bulk action-reference table that 'should be separate' but is inline, and there are no one-level-deep references to offload detail. It is above 2 (good structure, not minimal/buried) but below 4 (the inlined reference bulk is more than a 'minor organization gap').	3 / 5
	Total	13 / 20 Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description cleanly states what and when with an explicit 'Use when' trigger tied to a named tool, giving it decent distinctiveness. It is held back by the generic verb 'Manage', incomplete keyword coverage, and a trigger phrase that could be more concrete.

Suggestions

Replace the generic verb 'Manage' with specific actions, e.g. 'Run scans, triage findings, and manage rules and policies in Semgrep.'

Expand the trigger clause with concrete user phrases: 'Use when the user wants to run Semgrep scans, triage findings, or manage Semgrep rules and policies.'

Add common synonyms users actually say (findings, policies, code scan, static analysis) to improve trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Names the domain (Semgrep) and two concrete objects ('Manage Rules, Scans'), but the verb 'Manage' is generic and coverage is not comprehensive. It is above 2 (it does name concrete actions/objects) but below 4 (only a generic verb over two objects, not several specific actions).	3 / 5
Completeness	It explicitly states both what ('Semgrep integration. Manage Rules, Scans.') and when ('Use when the user wants to interact with Semgrep data.'). An explicit 'Use when...' clause is present so it is not capped at 3, but the 'when' is somewhat generic, fitting anchor 4 ('when could be more explicit or specific') rather than the concrete multi-trigger anchor 5.	4 / 5
Trigger Term Quality	Relevant natural keywords appear ('Semgrep', 'Rules', 'Scans'), but the trigger phrase 'interact with Semgrep data' is generic and common variations/synonyms a user would say ('findings', 'policies', 'code scan', 'static analysis') are missing. Not below 2 (more than one or two generic keywords) and not 4 (keyword coverage is incomplete rather than 'good with a few missing').	3 / 5
Distinctiveness Conflict Risk	Naming the specific tool 'Semgrep' gives it a clear niche with distinct triggers and minimal conflict risk, but 'Manage Rules, Scans' overlaps conceptually with other security/SAST scanning skills, so it is 'mostly distinct; minor overlap risk' rather than the unambiguous 5.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: membranedev/application-skills
Path: skills/semgrep/SKILL.md
Commit: f484c82

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.