skills.rest
endorlabs
endorlabsOFFICIAL
Explore all skills by this author →
Website𝕏@EndorLabsGitHub

endor-sast

Detect and report code-level security vulnerabilities in source code via Endor CLI SAST scans.

2|Updated Feb 4, 2026
Search Tags:#security#remediation#sast#vulnerabilities#static-analysis#false-positives#endor-sast
One-click install
npx skills add https://github.com/endorlabs/skills-ideas --skill endor-sast-endorlabs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: endor-sast
Source: https://github.com/endorlabs/skills-ideas/tree/main/skills/endor-sast
Command: npx skills add https://github.com/endorlabs/skills-ideas --skill endor-sast-endorlabs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Static code analysis to detect and report security vulnerabilities in source code, enabling proactive remediation.

Core Features & Use Cases

  • SAST scanning across languages to locate issues like SQL injection, XSS, and insecure patterns.
  • AI-assisted false positive reduction (requires Code Pro license) to improve triage efficiency.
  • Structured findings with file paths, line numbers, and remediation guidance for developers.

Quick Start

Run a SAST scan on your codebase to identify vulnerabilities and generate a remediation-ready report.

Frequently Asked Questions about endor-sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does SAST scanning detect and report code-level security vulnerabilities?▼

SAST scanning detects and reports code-level security vulnerabilities by analyzing source code across languages to locate insecure patterns like SQL injection and XSS. It provides structured findings with file paths and line numbers to guide remediation.

How do I run a SAST scan on my codebase to identify vulnerabilities?▼

You can run a SAST scan on your codebase to identify vulnerabilities through Endor CLI integration using the sast scan type. This generates a remediation-ready report detailing security issues detected in your source code.

Can I reduce false positives in static analysis results?▼

Yes, you can reduce false positives in static analysis results using the optional AI-assisted analysis flags. This AI false-positive reduction feature requires a Code Pro license to improve triage efficiency.

What is the best way to triage static analysis findings for SQL injection and XSS?▼

The best way to triage static analysis findings for SQL injection and XSS is to use AI-assisted false positive reduction. This filters out inaccurate alerts, leaving structured findings with file paths and line numbers for faster remediation.

Do I need a specific license to use AI SAST analysis features?▼

Yes, you need a Code Pro license to use the AI SAST analysis features. This license unlocks the optional --ai-sast-analysis flags that enable AI-assisted false positive reduction during your vulnerability scans.

Related Skills

Explore More Software Engineering Skills→
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-sast

Run static application security testing to detect code-level vulnerabilities in a repository.

Official
Advanced
melikhanmutlumelikhanmutlu

vulnerability-scanner

Detect security vulnerabilities in code and dependencies across codebases.

Community
Advanced
SergeiGolosSergeiGolos
1

vulnerability-scanner

Detect and prioritize security vulnerabilities across dependencies, secrets, code patterns, and configurations.

Community
Advanced
p-o-ke-naep-o-ke-nae

sast-configuration

Configure Semprep, SonarQube, CodeQL SAST scanning in CI/CD pipelines.

Community
Advanced