Static Analysis: Chaining CodeQL, Semgrep, and SARIF into a Reusable SAST Workflow
The static-analysis plugin in the Trail of Bits skills marketplace combines deep CodeQL analysis, Semgrep rule-set scanning, and SARIF parsing into reusable Agent workflows. It includes three skills—codeql, semgrep, and sarif-parsing—along with the run-scans.sh and merge_sarif.py scripts and the /static-analysis:semgrep-scan and /static-analysis:codeql-build workflows. The article covers installation commands, typical invocation patterns, approval gates, differences from read-only scanning, and practical constraints such as ensuring database build quality and disabling metrics, to help systematically implement SAST in AI-assisted security audits.
Read Moredsh-code-scan: Add Semgrep Code Scanning Capabilities to DeepSeek Harness Agent
The dsh-code-scan plugin is designed to address the challenges of integrating code security scanning tools with the DeepSeek Harness Agent. It wraps Semgrep and provides the Agent with a single tool interface, `code_scan`. The Agent only needs to provide a directory path, after which the plugin runs the scan locally and outputs a Chinese Markdown report grouped by file, line number, and severity level. The plugin includes a context protection mechanism that limits output to a maximum of 200 results to prevent context overflow, along with fault-tolerant handling. Before use, ensure that Semgrep is installed and configured locally. The installation command is `dsh plugin --profile web add dsh-code-scan`; the changes take effect after restarting the `dsh web` process.
Read MoreSemgrep-Rule-Creator: Using Agent to Write Testable Semgrep Security Rules
`semgrep-rule-creator` is an Agent Skill launched by Trail of Bits, used to create custom Semgrep rules that can detect security vulnerabilities, bug patterns and code patterns. Instead of running existing rule sets, it forces the Agent to produce rules following the workflow of test-first, AST analysis, priority given to taint mode, and optimization only after all tests pass. This article organizes the installation method, seven-step workflow, eval taint example and usage boundaries based on the official SKILL.md, plugin README and skill market description.
Read More