skills.rest
dandudzi
dandudziCOMMUNITY
Explore all skills by this author →
GitHub

sast-configuration

Automate SAST tool selection, configuration, and CI/CD integration.

2|Updated Mar 15, 2025
Search Tags:#ci/cd#security#sast#vulnerability scanning#semgrep#shift-left
One-click install
npx skills add https://github.com/dandudzi/dotfiles --skill sast-configuration-dandudzi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-configuration
Source: https://github.com/dandudzi/dotfiles/tree/main/dot_claude/skills/sast-configuration
Command: npx skills add https://github.com/dandudzi/dotfiles --skill sast-configuration-dandudzi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill streamlines the implementation and management of Static Application Security Testing (SAST) within development workflows, helping to identify and remediate security vulnerabilities early in the software development lifecycle.

Core Features & Use Cases

  • Tool Selection & Configuration: Guides users through choosing and setting up SAST tools like Semgrep, SonarQube, and CodeQL.
  • CI/CD Integration: Provides patterns for integrating SAST into pipelines for automated scanning.
  • Vulnerability Management: Covers secret scanning, dependency scanning, and strategies for managing false positives.
  • Shift-Left Strategies: Implements security checks earlier in the development process (pre-commit, PR gates).
  • Use Case: Integrate Semgrep into your GitHub Actions pipeline to automatically scan all pull requests for critical security flaws, failing the build if high-severity issues are detected.

Quick Start

Configure Semgrep with the OWASP Top 10 ruleset and integrate it into your GitHub Actions workflow.

Frequently Asked Questions about sast-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate SAST into my CI/CD pipeline to scan pull requests?▼

Integrating SAST into CI/CD pipelines automates vulnerability scanning for pull requests. This Skill provides configuration patterns to fail builds when high-severity issues are detected, using tools like Semgrep or CodeQL within workflows like GitHub Actions.

What is shift-left security and how does it apply to dependency scanning?▼

Shift-left security implements vulnerability checks early in the software development lifecycle. It utilizes dependency scanning and secret detection via tools like OWASP Dependency-Check or Snyk to identify and remediate flaws during pre-commit stages and PR gates.

How do I configure Semgrep with an OWASP Top 10 ruleset?▼

Configuring Semgrep with an OWASP Top 10 ruleset involves setting up the scanner to analyze code against standard vulnerability categories. This Skill guides tool selection and configuration to ensure comprehensive static analysis for critical security flaws.

Does this support both secret scanning and dependency scanning?▼

Yes, it supports both secret scanning and dependency scanning. The Skill covers comprehensive vulnerability management using tools like gitleaks and truffleHog for secrets, alongside OWASP Dependency-Check and Snyk for analyzing software dependencies.

What is the best way to choose between SonarQube, CodeQL, and Semgrep for static analysis?▼

Choosing between SonarQube, CodeQL, and Semgrep depends on your specific security analysis needs and CI/CD environment. This Skill provides guidance on tool selection, configuration, and managing false positives to optimize your shift-left deployment strategy.

Related Skills

Explore More Software Engineering Skills→
voidrotvoidrot

sast-configuration

Configure SAST tools like Semgrep, CodeQL, and SonarQube for CI/CD pipelines.

Community
Intermediate
williamzujkowskiwilliamzujkowski
17

nosql

Mitigate security vulnerabilities from insecure NoSQL patterns in database environments.

Community
Intermediate
bugrabilgebugrabilge
10

vulnerability-scanner

Detect security vulnerabilities in code, running apps, and dependencies.

Community
Advanced
Jia-Hong-PengJia-Hong-Peng

setup-deploy

Detects and configures deployment settings for platforms like Vercel, Netlify, and AWS, then persists them to CLAUDE.md for automated future use.

Community
Advanced