How do I install Semgrep Skills?

Install Semgrep Skills manually from semgrep/agent-skills, or use MCP Market Hub to sync and share them with your team.

Where can I download Semgrep Skills from source?

Download Semgrep Skills from semgrep/agent-skills.

How do I install these skills?

Download and sync to your agents with MCP Market hub: https://mcpmarket.com/hub. Or install manually from the GitHub repo: https://github.com/semgrep/skills

What AI agents can use Semgrep Skills?

Any agent that supports Skill.md can use these skills; see the Agent Skills specification: https://agentskills.io/specification. Compatible agents include Claude, Claude Code, Codex, and OpenCode.

Which programming languages do these skills support?

These skills support pattern-based code scanning across over thirty major languages, including Python, JavaScript, Go, and Java.

Can I use these skills to write custom rules?

Yes, you can write, test, and validate custom YAML rules using advanced taint-flow analysis.

Official

Semgrep Agent Skills

Q: Which agents support Semgrep Skills?

Semgrep Skills work with agents that support the Agent Skills format, including Claude, Claude Code, Codex, and OpenCode.

Equip your AI coding agents with Agent Skills to scan codebases for security vulnerabilities.

Install Semgrep Skills Browse 3 skills

Official Agent Skills published by Semgrep

What Semgrep skills help with

Run fast static analysis checks with Semgrep. Use these skills to enforce coding standards and detect injection flaws.

Scan for vulnerabilities

Find security flaws across thirty languages.

Top Semgrep skills

Official Agent Skills published by Semgrep.

View all

Code Security Guidelines

Provides comprehensive security rules and best practices to identify and prevent vulnerabilities across 15+ programming languages and infrastructure configurations.

Official

235

LLM Security Guidelines

Secures AI applications by implementing OWASP Top 10 for LLM 2025 standards and proactive vulnerability mitigation.

Official

235

Semgrep Static Analysis

Scans codebases for security vulnerabilities, identifies bug patterns, and enforces custom coding standards using fast, pattern-based static analysis.

Official

235

Install Semgrep SkillsforClaude|

Add Semgrep Skills to agents that support the Agent Skills format, including Claude, Claude Code, Codex, and OpenCode. Install manually from source, or use MCP Market Hub to sync and share them with your team.

Recommended

Install with MCP Market Hub

Add official skills once, keep them current across your agents, and share the same skill set with your team.

Install

Sync

Install with MCP Market Hub

Source repo

Download from source repo

Prefer manual control? Download the skills from source, then follow the install guide for your agent.

semgrep/agent-skills

Semgrep Agent Skill workflows

Real workflows powered by Semgrep skills.

Enforce custom coding standards
Create custom YAML rules to block deprecated APIs and verify internal guidelines.
Automate codebase security audits
Run static analysis scans to detect injection flaws on untrusted code.
Create secure CI pipelines
Configure automated security guardrails inside your GitHub Actions pipelines.