---
name: Semgrep Triage
slug: semgrep-triage
category: Quality
description: Semgrep Triage runs Semgrep through the mantis_semgrep MCP server to detect potential issues in code. It is used to review candidates, verify reachability, and decide whether results should be confirmed or rejected.
github: "https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/semgrep-triage"
language: Rust
stars: 490
forks: 73
install: "npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/semgrep-triage ~/.claude/skills/semgrep-triage"
installs_to: ~/.claude/skills/semgrep-triage
source_path: .codex/skills/semgrep-triage/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/deonmenezes/mantishack"
added: 2026-08-26T05:13:20.202Z
last_synced: 2026-08-26T05:13:20.202Z
canonical_url: "https://dirskills.com/skills/semgrep-triage"
---

# Semgrep Triage

Semgrep Triage runs Semgrep through the mantis_semgrep MCP server to detect potential issues in code. It is used to review candidates, verify reachability, and decide whether results should be confirmed or rejected.

**Install:**

```bash
npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/semgrep-triage ~/.claude/skills/semgrep-triage
```

## README

Use the `semgrep_scan` tool (mantis_semgrep MCP server) for the **Detect** stage of the Mantis pipeline: high-recall SAST over a file or directory.

- Default `config` to `"auto"`. Prefer a narrower ruleset (e.g. `"p/owasp-top-ten"`, `"p/secrets"`) when you already know the vulnerability class you're hunting.
- Every result is a `candidate`, not a finding. Do not report severity from semgrep's own `ERROR`/`WARNING`/`INFO` labels as final severity -- those describe rule confidence, not demonstrated impact.
- For each candidate: trace the exact source-to-sink path in the surrounding code before deciding it's worth validating further. If the sink is unreachable from attacker-controlled input (auth-gated, admin-only, framework-sanitized), reject it and cite the specific roadblock -- never "seems safe."
- Reachable candidates move to attacker-simulation validation (see `program-analysis` skill for the reachability tools) before you claim a confirmed finding.
- If `semgrep` reports `available: false`, tell the user it isn't installed rather than silently skipping SAST coverage.