sast-configuration

Name: sast-configuration
Availability: InStock
Author: arogyareddy

Configure Semgrep, SonarQube, and CodeQL for multi-language CI/CD security scanning.

Updated Apr 19, 2026

Search Tags:#security #sast #static-analysis #code-analysis #codeql #sonarqube #semgrep

Ready to run

npx skills add https://github.com/ArogyaReddy/https-github.com-wshobson-agents --skill sast-configuration-arogyareddy

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast-configuration
Source: https://github.com/ArogyaReddy/https-github.com-wshobson-agents/tree/main/plugins/security-scanning/skills/sast-configuration
Command: npx skills add https://github.com/ArogyaReddy/https-github.com-wshobson-agents --skill sast-configuration-arogyareddy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Core Features & Use Cases

Semgrep, SonarQube, and CodeQL setup across multiple languages and project types to enforce secure coding standards.
CI/CD integration with quality gates, hotspot analysis, and SARIF reporting to accelerate secure releases.
Remediation & governance baseline scans, false positive tuning, and policy enforcement to reduce risk.

Quick Start

Follow the initial baseline setup to enable automated vulnerability scanning across your repository.

Frequently Asked Questions about sast-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure SAST tools for multi-language projects in my CI/CD pipeline?▼

Configure SAST tools for multi-language projects by identifying primary languages and current CI/CD pipelines to tailor selection. Semgrep, SonarQube, and CodeQL are configured with baseline scans to automate vulnerability detection and enforce secure coding standards.

What is the best way to reduce false positives in static code analysis?▼

Reduce false positives in static code analysis by establishing baseline scans and performing false positive tuning. Quality gates and hotspot analysis help filter noise, ensuring that remediation guidance focuses on genuine vulnerabilities to improve your security posture.

Can I integrate CodeQL and Semgrep into existing CI workflows with SARIF reporting?▼

Yes, you can integrate CodeQL and Semgrep into existing CI workflows with SARIF reporting. This integration accelerates secure releases by automating vulnerability detection and standardizing security findings across different scanning tools within your pipeline.

When do I need to set up quality gates for SonarQube code analysis?▼

Set up quality gates for SonarQube code analysis when implementing DevSecOps practices to enforce policy compliance. Quality gates prevent insecure code from progressing through the pipeline by blocking releases that fail baseline scans or hotspot analysis thresholds.

Does static application security testing support remediation guidance for detected vulnerabilities?▼

Yes, static application security testing provides remediation guidance for detected vulnerabilities. After running baseline scans and hotspot analysis, the configuration delivers actionable remediation steps to developers, reducing risk and improving the overall security posture of the application.