← All skills
semgrep-skill
82 / 100 · Low risk
Fine to try.
By KimYx0207/Kim_Service (GitHub) · other · 187 stars · scanned at commit 853945a
Runs the installed local Semgrep CLI through a bounded JSON wrapper with two bundled non-secret rules. Requires an explicit authorized workspaceRoot and target. No remote rules, uploads, installs, source excerpts or automatic fixes.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README.
Found in 22 places.
Show 17 more
- skills/semgrep-skill/evals/professional-cases.json, line 36
"message": "Avoid shell=True when invoking subprocesses." - skills/semgrep-skill/evals/professional-cases.json, line 73
"scenario": "两条规则扫描发现shell=True；另一个候选结果漏掉一选中文件。", - skills/semgrep-skill/rules/local-security.yml, line 12
message: subprocess with shell=True can permit command injection. Prefer an argument list and shell=False. - skills/semgrep-skill/rules/local-security.yml, line 15
pattern: subprocess.$FUNC(..., shell=True, ...) - skills/semgrep-skill/scripts/scan.py, line 197
def stop_process(process: subprocess.Popen, env: dict[str, str]) -> None: - skills/semgrep-skill/scripts/scan.py, line 201
subprocess.run([str(taskkill), "/PID", str(process.pid), "/T", "/F"], - skills/semgrep-skill/scripts/scan.py, line 202
shell=False, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, - skills/semgrep-skill/scripts/scan.py, line 206
except (OSError, subprocess.SubprocessError): - skills/semgrep-skill/scripts/scan.py, line 215
process = subprocess.Popen(argv, cwd=scratch, env=env, shell=False, - skills/semgrep-skill/scripts/scan.py, line 216
stdin=subprocess.DEVNULL, stdout=stdout, stderr=stderr, - skills/semgrep-skill/scripts/scan.py, line 230
except subprocess.TimeoutExpired: - skills/semgrep-skill/scripts/scan.py, line 310
except (OSError, ValueError, KeyError, TypeError, UnicodeError, subprocess.SubprocessError): - skills/semgrep-skill/tests/fixtures/safe.py, line 3
subprocess.run(["echo", "safe"], shell=False, check=True) - skills/semgrep-skill/tests/fixtures/vulnerable.py, line 4
subprocess.run("echo unsafe", shell=True) - skills/semgrep-skill/tests/test_behavior.py, line 34
completed = subprocess.run( - skills/semgrep-skill/tests/test_installer.py, line 53
) -> subprocess.CompletedProcess[str]: - skills/semgrep-skill/tests/test_installer.py, line 63
return subprocess.run(
and 2 more places
Downloads and installs other software
The author does not mention this.
Found in 2 places.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'semgrep-skill' ] || [ -L ~/.agents/skills/'semgrep-skill' ]; then echo 'A skill folder named semgrep-skill already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/KimYx0207/Kim_Service' "$d" && git -C "$d" checkout --quiet '853945a296f991a39535359e44e0f6d9d93ee94f' -- 'skills/semgrep-skill' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/semgrep-skill' ~/.agents/skills/'semgrep-skill' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'semgrep-skill' ~/.claude/skills/'semgrep-skill' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for KimYx0207/Kim_Service shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/KimYx0207/Kim_Service/)
Score history
| Date | Version | Score |
|---|
| 2026-11-14 | 853945a | 82 |