testland/semgrep-rules
Configures and runs Semgrep - pattern-based SAST across 30+ languages with the Semgrep Registry rulesets (`p/owasp-top-ten`, `p/default`, `auto`) plus custom YAML rules; integrates `semgrep ci` for PR-blocking gates with `--baseline-commit` diff-aware scanning, per-finding inline `nosemgrep` suppressions, `--exclude` / `--include` path filters, output formats (`--json` / `--sarif` / `--gitlab-sast` / `--junit-xml`), and severity filter (INFO/WARNING/ERROR). Use when the user runs Semgrep, asks about pattern rules, or needs a low-friction SAST gate without semantic-DB setup.
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
cli-reference.mdreferences/
Semgrep CLI reference
Full flag, output-format, and exit-code detail for semgrep-rules. The
SKILL.md spine keeps the common commands; this file holds the exhaustive
tables. All entries per
semgrep.dev/docs/cli-reference.
Output formats
| Flag | Purpose |
|---|---|
--json | Semgrep JSON format (for multi-scanner triage) |
--sarif | SARIF format (GitHub Code Scanning upload) |
--gitlab-sast | GitLab SAST format (GitLab Security Dashboard) |
--junit-xml | JUnit XML (test reporters) |
--text | Default human-readable |
--output VAL | Write to file or URL |
Performance flags
semgrep scan -j 8 --timeout 10 --max-target-bytes 5000000-j VALUE- Parallelism degree (default: 3)--timeout=DOUBLE- Per-rule per-file timeout in seconds (default: 5.0)--max-target-bytes=VALUE- Skip files exceeding size (default: 1000000)
Exit codes
| Code | Meaning |
|---|---|
| 0 | Success, no issues |
| 1 | Issues detected (with --error flag) |
| 2 | Fatal error |
| 3 | Invalid syntax in scanned language |
| 4 | Invalid pattern in rule |
| 5 | Invalid YAML configuration |
| 7 | Invalid rule in configuration |
| 8 | Unsupported language specified |
| 13 | Invalid API key |
The spine gates on 0 (pass) / 1 (findings) / 2 (fatal); the rest signal config or rule authoring errors.