utkusenCommunity·16 Agent Skills Included

sast-skills

Turn your AI coding assistant into a full security vulnerability scanner

Scans any codebase for 14 vulnerability classes including SQL injection, XSS, SSRF, RCE, IDOR, and hardcoded secrets. Maps your architecture first, then runs all detection checks in parallel without external security tools. Produces a consolidated report ranked by severity with proof, remediation steps, and test commands.

1,265|61

↗

npx skills add utkusen/sast-skills --all -g -y

Available:

Directs the AI agent through a three-step security assessment: map the codebase architecture, run all vulnerability detection skills in parallel as subagents, then consolidate findings into one severity-ranked report.

All Skills in This Repository (16)

Pure Emerald Level Indicators

📦 In Repo

utkusen

sast-ssrf

Identifies and quantifies SSRF vulnerabilities by tracing user input to outbound network calls.

sast-hardcodedsecrets

Scan codebases for hardcoded secrets and write findings to markdown files.

sast-pathtraversal

Trace user-controlled path inputs through file operations and report path traversal vulnerabilities.

sast-sqli

Detect SQL injection vulnerabilities via recon, parallel verification, and merged results.

sast-graphql

Detect unsafe GraphQL operation document construction with user input tracing.

sast-businesslogic

Identify business logic vulnerabilities and generate prioritized threat scenarios.

sast-analysis

Map codebase architecture and technology stack into sast/architecture.md.

sast-missingauth

Detect missing authentication and broken function-level authorization in codebases.

sast-report

Consolidate SAST findings from sast/*-results.md into a prioritized final-report.md.

sast-idor

Identify and map IDOR vulnerabilities in REST or GraphQL endpoints.

sast-ssti

Trace dynamic template strings to detect SSTI vulnerabilities across multi-language codebases.

sast-xss

Detect Cross-Site Scripting vulnerabilities by tracing user input through rendering sinks.

Community

Advanced

Frequently Asked Questions

FAQPage Schema

How to install sast-skills?▼

Run `npx skills add utkusen/sast-skills --all -g -y` in your terminal to install all security scanning skills globally.

What vulnerabilities can sast-skills detect?▼

It detects 14 classes including SQL injection, XSS, SSRF, RCE, XXE, path traversal, insecure file upload, JWT flaws, missing authentication, IDOR, business logic flaws, GraphQL injection, and hardcoded secrets.

How do I run a security scan on my codebase?▼

Copy your project into the sast-files folder, open it in your AI assistant, and ask it to run a vulnerability scan. The orchestrator file handles the full workflow automatically.

Does sast-skills work with Claude Code and Cursor?▼

Yes. It works natively with Claude Code, Codex, Opencode, Cursor, and any assistant that supports agent skills, with no third-party tools required.

Do I need security expertise to use sast-skills?▼

No. The skills guide your AI agent through recon, verification, and reporting automatically, and the final report explains each finding with fixes and test steps.