Skip to content

Trail of Bits Semgrep Scan

A planned, approved Semgrep scan with SARIF output, from the Trail of Bits team.

Official vendorby Trail of BitsChecked October 18, 2026

From the security firm Trail of Bits, this skill runs Semgrep the way an auditor would. It detects languages, proposes rulesets for your approval, runs them in batches and merges results into SARIF.

Who it is for

  • Security engineers
  • Developers
  • Auditors

Prompts to try

Once the skill is installed, ask for the result in plain words. Claude picks the skill up on its own.

Prompt 1
Scan this codebase for vulnerabilities with Semgrep
Prompt 2
Run only the important Semgrep security rules on this repo
Prompt 3
Do a static analysis pass before our security review

How to install it

In Claude Code

  1. /plugin marketplace add trailofbits/skills
  2. /plugin install static-analysis@trailofbits

In Claude.ai

Not practical in Claude.ai because the skill drives local command-line tools, so use Claude Code.

Good to know

The static-analysis plugin also includes CodeQL and SARIF parsing skills.

Unlock the install steps

Free. Leave your email once to open the install steps for all 149 skills, and get the best new skills each month.

No spam. One click to unsubscribe. We use your email to send you the course and AI tips.

How we checked it

Confirmed SKILL.md at plugins/static-analysis/skills/semgrep/SKILL.md in trailofbits/skills via the GitHub API; skill folder last changed 2026-09-28, repo has 7,620 stars and was pushed 2026-10-15.

Source: github.com/trailofbits/skills/tree/main/plugins/static-analysis/skills/semgrep

More security skills