sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

3|1|Updated Feb 3, 2026

Search Tags:#security #sast #ci-cd #code-analysis #codeql #sonarqube #semgrep

Ready to run

npx skills add https://github.com/duanbiao2000/obsidianDoc26 --skill sast-configuration-duanbiao2000

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast-configuration
Source: https://github.com/duanbiao2000/obsidianDoc26/tree/main/agents-main/plugins/security-scanning/skills/sast-configuration
Command: npx skills add https://github.com/duanbiao2000/obsidianDoc26 --skill sast-configuration-duanbiao2000

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection across codebases, enabling teams to catch security issues earlier and reduce remediation effort.

Core Features & Use Cases

Semgrep Configuration: Custom rule creation with pattern matching across languages (Python, JavaScript, Go, Java, etc.), enabling fast, language-aware security checks.
SonarQube Setup: Quality gate configuration, security hotspot analysis, and code quality tracking with enterprise integration options.
CodeQL Analysis: GitHub Advanced Security integration, custom query development, and vulnerability variant analysis for secure code research workflows.

Quick Start

Run a baseline SAST scan to establish the security posture and integrate the chosen tools into your CI/CD workflow.

Frequently Asked Questions about sast-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure SAST tools for automated vulnerability detection in a CI/CD pipeline?▼

Configure SAST tools for automated vulnerability detection by specifying setup steps, customizing rules, and integrating scanning into CI/CD pipelines to catch security issues early across codebases.

What is the best way to integrate Semgrep, SonarQube, and CodeQL for DevSecOps workflow automation?▼

Integrate Semgrep, SonarQube, and CodeQL for DevSecOps automation by applying language-aware pattern matching, configuring quality gates, and running variant analysis to enforce policy compliance across multi-language projects.

Can I use custom CodeQL queries for vulnerability variant analysis in GitHub Advanced Security?▼

CodeQL analysis supports GitHub Advanced Security integration, custom query development, and vulnerability variant analysis for secure code research workflows to detect security issues early.

Does Semgrep support custom rule creation with pattern matching across multiple programming languages?▼

Semgrep configuration enables custom rule creation with pattern matching across languages like Python, JavaScript, Go, and Java, delivering fast, language-aware security checks for codebases.

How do I set up SonarQube quality gates to track security hotspots and code quality?▼

SonarQube setup involves quality gate configuration, security hotspot analysis, and code quality tracking with enterprise integration options to establish baseline security posture and enforce compliance.

What are the limitations of running baseline SAST scans across multi-language projects?▼

Baseline SAST scans across multi-language projects require careful rule customization and tool integration to avoid false positives, detect security issues early, and reduce remediation effort in CI/CD workflows.