sast

Name: sast
Availability: InStock
Author: Simplerick

Scan source code for security flaws and produce markdown findings.

Updated Jan 26, 2026

Search Tags:#static analysis #security #dependencies #secrets #vulnerabilities #code-review

Ready to run

npx skills add https://github.com/simplerick0/com.ackhax.configs --skill sast

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast
Source: https://github.com/simplerick0/com.ackhax.configs/tree/main/skills/security/sast
Command: npx skills add https://github.com/simplerick0/com.ackhax.configs --skill sast

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SAST helps teams identify security flaws and insecure patterns in source code without executing it, reducing risk during development.

Core Features & Use Cases

Secret detection: Find hardcoded credentials, API keys, tokens, and private keys.
Injection and configuration flaws: Flag common injection vectors, insecure deserialization, and misconfigurations.
Dependency and build risk: Detect vulnerable or outdated dependencies and typosquatting risks.
Use Case: A software project can automatically scan a repository to surface secrets and insecure patterns, producing actionable remediation guidance.

Quick Start

Run a static code review on your project and review the generated findings report.

Frequently Asked Questions about sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a static security analysis to detect hardcoded secrets in my codebase?▼

Run a static security analysis to scan your repository and identify hardcoded credentials, API keys, and tokens. This process reviews code without execution, producing a structured markdown report with actionable remediation guidance.

What's the best way to scan source code for insecure patterns and configuration flaws?▼

Scanning source code for insecure patterns and configuration flaws involves analyzing code and project configurations without execution. This method flags injection vectors, insecure deserialization, and misconfigurations, generating a structured markdown report of findings.

Can I use static analysis to check dependency manifests for vulnerable or outdated packages?▼

Yes, you can use static analysis to check dependency manifests for vulnerable or outdated packages. This process detects dependency risks, including typosquatting, by scanning manifests and build configurations to produce a structured findings report.

Does static code review work for finding security flaws across different programming languages?▼

Static code review works across different programming languages to identify security flaws. By analyzing code, dependency manifests, and project configurations, it surfaces insecure patterns and generates actionable remediation guidance in a structured markdown format.

What types of security flaws can a static code review identify without executing the code?▼

A static code review can identify hardcoded secrets, injection vectors, insecure deserialization, misconfigurations, and vulnerable dependencies without executing the code. It scans code and manifests to produce a structured markdown report of these findings.