Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add backspace-shmackspace/claude-devkit --skill semgrepgit clone --depth 1 https://github.com/backspace-shmackspace/claude-devkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/backspace-shmackspace/claude-devkit/semgrep)<a href="https://agentmods.dev/skills/backspace-shmackspace/claude-devkit/semgrep"><img src="https://agentmods.dev/badge/skills/backspace-shmackspace/claude-devkit/semgrep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/backspace-shmackspace/claude-devkit/semgrep"><img src="https://agentmods.dev/badge/skills/backspace-shmackspace/claude-devkit/semgrep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00095 | $0.06569 |
| Opus 5.5 | $0.00038 | $0.02628 |
| Sonnet 5.5 | $0.00019 | $0.01314 |
| Haiku 4.5 | $0.00010 | $0.00657 |
Grade B, and why
semgrep scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
[ -n "[OUTPUT_DIR]" ] && rm -rf [OUTPUT_DIR]/repos Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
This is a copy
91% identical to semgrep — 23 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 559 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Semgrep Security Scan
Run a Semgrep scan with automatic language detection, parallel execution across language groups, and merged SARIF output.
Essential Principles
- Always use
--metrics=off— Semgrep sends telemetry by default;--config autoalso phones home. Everysemgrepcommand must include--metrics=offto prevent data leakage during security audits. - User must approve the scan plan (Step 3 is a hard gate) — The original "scan this codebase" request is NOT approval. Present exact rulesets, target, engine, and mode; wait for explicit "yes"/"proceed" before running scanners.
- Third-party rulesets are required, not optional — Trail of Bits, 0xdea, and Decurity rules catch vulnerabilities absent from the official registry. Include them whenever the detected language matches.
- Run all scan workers in parallel — Parallel execution is the core performance advantage. Do not run language scans strictly one-after-another when independence allows overlap.
- Always check for Semgrep Pro before scanning — Pro enables cross-file taint tracking and catches ~250% more true positives. Skipping the check means silently missing critical inter-file vulnerabilities.
When to Use
- Security audit of a codebase
- Finding vulnerabilities before code review
- Scanning for known bug patterns
- First-pass static analysis
When NOT to Use
- Binary analysis → Use binary analysis tools
- Already have Semgrep CI configured → Use existing pipeline
- Need cross-file analysis but no Pro license → Consider CodeQL as alternative
- Creating custom Semgrep rules → Use
semgrep-rule-creatorskill - Porting existing rules to other languages → Use
semgrep-rule-variant-creatorskill
Output Directory
All scan results, SARIF files, and temporary data are stored in a single output directory.
- If the user specifies an output directory in their prompt, use it as
OUTPUT_DIR. - If not specified, default to
./static_analysis_semgrep_1. If that already exists, increment to_2,_3, etc.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 559 lines · 95 tokens per session scan B 3ad46fa0988f
semgrep is a skill published in the GitHub repository backspace-shmackspace/claude-devkit (15 stars, last pushed 2mo ago), licensed MIT. It adds 95 tokens to every session and 6,569 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (recursive force delete). It is 91% identical to semgrep, differing in 23 lines, and is treated as a copy.
Other skills, from other repositories
architect
Produces Alon's design-doc system before code: SOURCEOFTRUTH.md, ARCHITECTUREROADMAP.md, TODOWORKFLOW.md, CLAUDE.md, plus a modular docs/architecture set for larger projects. Model first: data and invariants before framework, every invariant enforced at two boundaries, failure paths designed as deliberately as happy…
ponytail
Forces the laziest solution that actually works: YAGNI, reuse before new code, stdlib before custom, native platform before dependencies, one line before fifty. Three levels — lite (name the lazier alternative, build what's asked), full (ladder enforced, default), ultra (YAGNI extremist, challenge the requirement…
review-swarm
Local, free, multi-specialist review of a diff: parallel Claude subagents for correctness, security/trust boundaries, data/perf, architecture-altitude, ponytail-simplicity, and tests/failure-paths, each non-trivial finding adversarially verified before being kept, deduped, and ranked into a Blockers / Should-fix /…
ask-the-council
Convenes a panel of opinionated Claude advisors, each with a distinct mandate and a forbidden move so they genuinely diverge, then a Chairman synthesis that commits to one recommendation with the decisive tradeoff and the strongest dissent named.
prompt-generator
Turns a vague ask into a rigorous, grounded, token-efficient prompt for another agent or LLM: role and objective, testable done criteria, anti-hallucination and anti-tokenmaxing rules baked into the generated prompt itself, and strict agent discipline for coding-agent hand-offs.
up-to-date
Preflight sync and situational brief before repo work: fetches origin, reports ahead/behind divergence (with a no-upstream/detached-HEAD fallback), recent commits, open PRs and issues touching the work, and dirty-tree warnings, then names one recommended first action. Read-only by default — never pulls, rebases…