Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Semgrep Triage · deonmenezes | DecimalAI

securityby deonmenezes

Semgrep Triage

deonmenezes/semgrep-triage

Source deonmenezes/mantishack ↗License Apache-2.0

Run semgrep via the mantis_semgrep MCP server and triage results into the candidate/confirmed/rejected lifecycle

SkillScore59Maintained

Automatic

Security & AppSec pack

Last verified 8/19/2026

What it changes

Passed 11 of 18 test cases with the skill, and 8 of 18 without it.

Without skill45%

With skill59%

Checks it passed that the model alone missed

Notifies the user that semgrep is not installed in the environment.
Identifies semgrep static scanning as serving the Detect stage of the pipeline.
Explains that scanner severity labels indicate rule confidence rather than demonstrated impact.

and 1 more in the full report

4 fixed9 passed either way8 still failing1 broke

Pass-rate lift: +14 pp
Tokens: -12%
Agent turns: 0%
Response time: -11%

Model gemini-3.6-flashMeasured 8/19/2026v113 of 22 cases passed with skill · 18 comparable

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/deonmenezes-semgrep-triage/SKILL.md https://app.decimal.ai/s/deonmenezes-semgrep-triage/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add deonmenezes-semgrep-triage, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/deonmenezes-semgrep-triage/ and pins it in .decimal/skills.lock

decimalai skills add deonmenezes-semgrep-triage

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/deonmenezes-semgrep-triage/SKILL.md https://app.decimal.ai/s/deonmenezes-semgrep-triage/SKILL.md

Raw file: /s/deonmenezes-semgrep-triage/SKILL.md ↗ · machine-readable summary at /s/deonmenezes-semgrep-triage.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

What's inside

The instructions your model reads when the skill loads.

SKILL.md7 linessingle file

Use the semgrep_scan tool (mantis_semgrep MCP server) for the Detect stage of the Mantis pipeline: high-recall SAST over a file or directory.

Default config to "auto". Prefer a narrower ruleset (e.g. "p/owasp-top-ten", "p/secrets") when you already know the vulnerability class you're hunting.
Every result is a candidate, not a finding. Do not report severity from semgrep's own ERROR/WARNING/INFO labels as final severity -- those describe rule confidence, not demonstrated impact.
For each candidate: trace the exact source-to-sink path in the surrounding code before deciding it's worth validating further. If the sink is unreachable from attacker-controlled input (auth-gated, admin-only, framework-sanitized), reject it and cite the specific roadblock -- never "seems safe."
Reachable candidates move to attacker-simulation validation (see program-analysis skill for the reachability tools) before you claim a confirmed finding.
If semgrep reports available: false, tell the user it isn't installed rather than silently skipping SAST coverage.

Track record

Benchmark

11 / 18

test cases passed, vs 8 / 18 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

deonmenezes / mantishack

.codex/skills/semgrep-triage/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/3/2026Version v1

More skills from the same source and nearby in the registry, with their headline benchmark lift.