Agent Plugins Marketplace
← All plugins

static-analysis

v1.4.4

Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection

Claude Code3 Skills

By Axel Mierczuk & Paweł Płatek7.1k GitHub starsUpdated last week

Directory evidence

Runtimes
Claude Code
Parsed components
3 skill or MCP entries
Source updated
Sep 16, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install static-analysis for Claude Code

Installs for the current user
claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install static-analysis@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/trailofbits/skills

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/static-analysis/.

Plugin files

plugins/static-analysis/
├── .claude-plugin/plugin.json
├── skills/codeql/SKILL.md
├── skills/sarif-parsing/SKILL.md
└── skills/semgrep/SKILL.md

Included Skills3

codeqlskills/codeql/SKILL.md

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.

sarif-parsingskills/sarif-parsing/SKILL.md

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.

semgrepskills/semgrep/SKILL.md

Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.

Plugin manifests1

plugins/static-analysis/.claude-plugin/plugin.json
{
  "name": "static-analysis",
  "version": "1.4.4",
  "description": "Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection",
  "author": {
    "name": "Axel Mierczuk & Paweł Płatek"
  },
  "interface": {
    "displayName": "Static Analysis",
    "shortDescription": "Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection",
    "longDescription": "Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection",
    "developerName": "Axel Mierczuk & Paweł Płatek"
  }
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[static-analysis on Agent Plugins Marketplace](https://pluginsmp.com/plugins/static-analysis)