Semgrep security finding remediation — fetch, fix, and verify 'to fix' findings from the Semgrep AppSec Platform
npx claudepluginhub kinginyellows/yellow-plugins --plugin yellow-semgrepFix multiple 'to-fix' Semgrep findings with human approval between each fix. Use when user says 'fix all findings', 'batch fix', 'remediate everything', or wants to work through the to-fix queue.
Fix a single Semgrep finding: fetch details, analyze vulnerability, apply fix (autofix or LLM), verify via re-scan, and update triage state. Use when user says 'fix finding 12345', 'remediate this issue', or references a specific finding ID.
Run local Semgrep scan and compare results with platform findings. Use when user says 'scan for issues', 'check security', 'run semgrep', or wants to verify local code against the Semgrep platform.
Validate SEMGREP_APP_TOKEN, test MCP connection, detect deployment slug, and cache configuration. Use when first installing the plugin, after token rotation, or on auth errors.
Show findings dashboard grouped by triage state and severity. Use when user asks 'semgrep status', 'what needs fixing', 'how many findings', or wants to see the current state of security findings.
Security finding fix specialist. Applies deterministic autofix first, falls back to LLM-generated fix. Shows diff for approval before applying. Spawned by /semgrep:fix and /semgrep:fix-batch.
Post-fix verification specialist. Re-scans with the specific rule to confirm finding is resolved, then full-scans for regressions. Spawned by /semgrep:fix after a fix is applied.
Requires secrets
Needs API keys or credentials to function
Uses power tools
Uses Bash, Write, or Edit tools
Share bugs, ideas, or general feedback.
Create custom Semgrep rules for detecting bug patterns and security vulnerabilities
Open-source cybersecurity analysis agent. Scans any local project for vulnerabilities: code security (SAST), dependency CVEs (SCA), secret leaks, authentication/authorization flaws, cryptographic weaknesses, misconfigurations, supply chain risks, and CI/CD security. Covers all OWASP 2025 Top 10 and CWE Top 25 categories. Generates prioritized reports with remediation guidance. Invoke with /cyber-neo [path].
Check OWASP Top 10 compliance
The most comprehensive Claude Code plugin — 48 agents, 182 skills, 68 legacy command shims, selective install profiles, and production-ready hooks for TDD, security scanning, code review, and continuous learning
Efficient skill management system with progressive discovery — 410+ production-ready skills across 33+ domains
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge.
Sign in to claim