skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

sast-config

Review and tune Semgrep and CodeQL SAST configurations against OWASP ASVS 4.0.3.

44|128|Updated Mar 6, 2026
Search Tags:#sast#codeql#semgrep#ci integration#cwe top 25#owasp asvs
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill sast-config-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-config
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/devsecops/sast-config
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill sast-config-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents inaccurate or noisy SAST results by reviewing and tuning Semgrep, CodeQL, and SAST CI configurations so findings map to real OWASP ASVS 4.0.3 verification requirements and the CWE Top 25.

Core Features & Use Cases

  • ASVS- and CWE-grounded SAST assessment: Evaluates rule coverage gaps and ensures severity tuning aligns with organizational risk.
  • Semgrep rule configuration review: Checks managed-rule usage, custom rule structure, ignore/suppression hygiene, and CI failure behavior.
  • CodeQL configuration and query pattern review: Verifies query suite selection, path exclusions, and query-filter-based handling of known false positives.
  • False positive and severity management: Provides workflows for triage, suppression justification requirements, and CI gating recommendations.

Quick Start

Ask an AI coding agent to review your repo’s SAST configuration and tuning by targeting the directory that contains your .semgrep and CodeQL configuration.

Frequently Asked Questions about sast-config

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I tune Semgrep and CodeQL rules to reduce false positives?▼

Tune Semgrep and CodeQL rules by reviewing query suite selections, verifying path exclusions, and applying query-filter-based handling for known false positives while validating suppression hygiene and severity alignment.

How do I map SAST findings to OWASP ASVS 4.0.3 and CWE Top 25?▼

Map SAST findings to OWASP ASVS 4.0.3 and CWE Top 25 by evaluating rule coverage gaps and aligning severity tuning with organizational risk to produce an ASVS-aligned maturity and remediation report.

What is the best way to enforce SAST CI gates without blocking builds?▼

Enforce SAST CI gates by reviewing CI failure behavior and applying triage workflows with suppression justification requirements to ensure only validated findings block builds while managing false positives.

Can I use this to review custom Semgrep rules and CodeQL configurations?▼

Yes, you can review custom Semgrep rules and CodeQL configurations. It checks managed-rule usage, custom rule structure, ignore hygiene, query suite selection, and path exclusions to validate configuration best practices.

When do I need to perform a SAST rule gap analysis?▼

Perform a SAST rule gap analysis during post-incident reviews, periodic tuning, or SAST deployment to map findings and rule coverage to OWASP ASVS 4.0.3 and CWE Top 25 for identifying missing detection capabilities.

Related Skills

Explore More Software Engineering Skills→
camoneartcamoneart
5

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection in CI/CD pipelines.

Community
Advanced
mahg-esmahg-es
3

secure-code

Review source code for security vulnerabilities with CWE mappings and concrete fixes.

Official
Advanced
jaskaranhundaljaskaranhundal
3

sast-dast-coordinator

Orchestrate SAST, DAST, SCA, and secrets scanning tools to correlate and prioritize findings.

Community
Advanced
bejranondabejranonda
27

web-validation

Detect JavaScript errors and collect browser diagnostics from web pages.

Community
Advanced