code-reaper

Identify and remediate security weaknesses in source code via static analysis.

1|Updated Apr 3, 2026

Search Tags:#security #vulnerability #multi-language #static-analysis #code-review #SAST

Ready to run

npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill code-reaper

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: code-reaper
Source: https://github.com/mlvpatel/sentinel-ai-offensive/tree/main/skills/code-reaper
Command: npx skills add https://github.com/mlvpatel/sentinel-ai-offensive --skill code-reaper

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Static code reviews are time-consuming and error-prone; code-reaper automates deep static analysis to reveal vulnerabilities across many languages and security patterns.

Core Features & Use Cases

Deep multi-language SAST with support for 12 languages (JavaScript/TypeScript, Python, PHP, Go, Ruby, Rust, Java, C#, Solidity, Kotlin, Swift, Dart) and integration with Semgrep, Gitleaks, and Trufflehog.
Taint analysis, auth-architecture audit, secret detection, and dependency risk assessment to prioritize remediation.
Use Case: A security engineer runs a full SAST pass on a codebase and receives a prioritized list of actionable findings with remediation guidance.

Quick Start

Run a full SAST pass on your codebase to generate a prioritized vulnerability report.

Frequently Asked Questions about code-reaper

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run static analysis to find security vulnerabilities across multiple programming languages?▼

Static analysis detects security weaknesses by applying SAST workflows, taint analysis, and secret detection across source code to produce prioritized remediation guidance.

What is the best way to automate secret detection and dependency risk analysis in a codebase?▼

Automate secret detection and dependency risk analysis by integrating Gitleaks and Trufflehog into your SAST workflow to reveal hardcoded secrets and evaluate dependency vulnerabilities.

Does deep SAST work with Solidity and smart contract vulnerability pattern hunting?▼

Yes, deep SAST supports Solidity alongside 11 other languages, applying framework-specific vulnerability patterns and taint analysis to identify security weaknesses in smart contracts.

How do I perform an auth architecture audit using Semgrep?▼

Perform an auth architecture audit by applying Semgrep rules within your SAST workflow to analyze authentication flows, detect access control misconfigurations, and prioritize remediation.

Can I use taint analysis to identify and remediate security weaknesses in Rust and Swift?▼

Yes, you can use taint analysis to identify and remediate security weaknesses in Rust and Swift, as the SAST workflow explicitly supports both languages for automated scanning and manual pattern hunting.

Why does static code review need automated taint analysis and framework-specific vulnerability patterns?▼

Automated taint analysis and framework-specific vulnerability patterns are needed because manual static code reviews are time-consuming and error-prone, whereas deep SAST automates detection to reveal vulnerabilities across many languages.