apex-pipeline

Orchestrate seven-phase application security testing from intake to report.

1|Updated Apr 3, 2026

Search Tags:#automation #reporting #pipeline #security-testing #recon #application-security #sast-dast

Ready to run

npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill apex-pipeline

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: apex-pipeline
Source: https://github.com/mlvpatel/sentinel-ai-offensive/tree/main/skills/apex-pipeline
Command: npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill apex-pipeline

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Unified app security testing is typically fragmented across recon, SAST, DAST, and reporting. apex-pipeline assembles these into a single orchestrated workflow that automates phase transitions and enforces consistency across targets.

Core Features & Use Cases

End-to-end security workflow from intake to report.
Supports web apps, mobile backends, APIs, GraphQL, REST, and microservices.
Integrates with SAST/DAST tools (semgrep, nuclei, dalfox, ffuf, trufflehog, grep).
Use Case: Kick off a full assessment on a new project to generate a repeatable security report.

Quick Start

Run apex-pipeline against your target to initiate the end-to-end app security assessment.

Frequently Asked Questions about apex-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate end-to-end application security testing from intake to report?▼

Automate application security testing by orchestrating recon, SAST, DAST, manual hunting, validation, and reporting into a single seven-phase workflow with automated phase transitions. This pipeline enforces consistent, compliant findings across web apps, APIs, and microservices.

What is the best way to run SAST and DAST together for web app security?▼

The best way to run SAST and DAST together is using an orchestrated pipeline that integrates semgrep, nuclei, dalfox, ffuf, trufflehog, and grep. This approach combines static and dynamic analysis, automating transitions between recon, testing, and validation phases.

Can I use this security testing pipeline for GraphQL and REST APIs?▼

Yes, you can use this pipeline for GraphQL and REST APIs, as well as mobile backends and microservices. It guides security testing from intake to report across these target types, applying automated phase transitions for consistent results.

Does apex-pipeline require specific tools to run the security assessment?▼

Apex-pipeline requires integration with SAST and DAST tools including semgrep, grep, trufflehog, nuclei, ffuf, and dalfox. These tools power the seven-phase workflow, ensuring consistent and compliant findings across the end-to-end assessment.

How does automated phase transition work in a security testing workflow?▼

Automated phase transitions work by orchestrating a seven-phase workflow that progresses from intake through recon, SAST, DAST, manual hunting, and validation to reporting. This eliminates manual handoffs, ensuring consistent and compliant security findings.

What are the limitations of using automated pipelines for application security testing?▼

Automated pipelines for application security testing rely on specific tool integrations like semgrep and nuclei, and follow a fixed seven-phase workflow. While automation enforces consistency, manual hunting remains a phase, indicating automated tools alone cannot cover all security findings.