skills.rest
NorkzYT
NorkzYTCOMMUNITY
Explore all skills by this author →
GitHub

sast-configuration

Configure and tune SAST tools for automated vulnerability detection in CI/CD pipelines.

2|2|Updated Jan 21, 2026
Search Tags:#security#DevSecOps#sast#codeql#sonarqube#semgrep#code scanning
One-click install
npx skills add https://github.com/NorkzYT/claude-code-autopilot --skill sast-configuration-norkzyt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-configuration
Source: https://github.com/NorkzYT/claude-code-autopilot/tree/main/.claude/skills/sast-configuration
Command: npx skills add https://github.com/NorkzYT/claude-code-autopilot --skill sast-configuration-norkzyt

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) and references (resource) components.

What problem does it solve?

This Skill configures and tunes Static Application Security Testing (SAST) tools to automatically detect vulnerabilities in code, enabling faster remediation and stronger secure-by-default practices.

Core Features & Use Cases

  • SAST tool setup: Guidance for Semgrep, SonarQube, and CodeQL across multiple languages.
  • CI/CD integration: Baseline configurations and quality gates within pipelines to enforce secure coding standards.
  • Policy creation & optimization: Custom rules and false-positive tuning to reduce noise and accelerate fixes.
  • Use Case: Example: integrate SAST into a GitHub Actions workflow to scan Python and JavaScript code on push and fail builds on critical findings.

Quick Start

Use this skill to configure SAST scanning in your project by selecting your languages and tooling, then generate a starter configuration and run a baseline scan.

Frequently Asked Questions about sast-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure SAST tools like Semgrep and CodeQL for a multi-language codebase?▼

Configuring SAST tools for multi-language codebases involves selecting appropriate tooling like Semgrep, SonarQube, or CodeQL, then generating a baseline configuration to enable automated vulnerability detection across your project.

What is the best way to integrate static application security testing into a GitHub Actions CI/CD pipeline?▼

Integrating static application security testing into GitHub Actions CI/CD pipelines requires adding baseline configurations and quality gates to scan code on push and fail builds when critical vulnerabilities are detected.

How can I reduce false positives in SonarQube code scanning rules?▼

Reducing false positives in SonarQube code scanning requires custom rule creation and false-positive tuning to minimize noise, enabling developers to focus on actual vulnerabilities and accelerate remediation efforts.

Does SAST configuration support enforcing quality gates for DevSecOps workflows across different teams?▼

SAST configuration supports DevSecOps workflows by establishing quality gates within CI/CD pipelines, which enforces secure coding standards across teams and ensures secure software development practices.

When do I need custom rules for code scanning instead of default SAST tool configurations?▼

Custom rules for code scanning are needed when default SAST tool configurations produce excessive noise or fail to detect specific vulnerabilities, requiring policy creation and optimization for accurate automated detection.

Related Skills

Explore More Software Engineering Skills→
d-padmanabhand-padmanabhan
15

codebase-security-audit

Audit codebases with secrets scanning, SAST, SCA, and IaC validation.

Community
Advanced
franroafranroa

Test Master

Plan, automate, and execute functional, performance, and security tests in CI/CD pipelines.

Community
Advanced
brenordvbrenordv

security

Audit software systems for security vulnerabilities and regulatory compliance.

Community
Advanced
Ed1s0nZEd1s0nZ
5.6k

mobile-app-security-testing

Analyze Android and iOS applications for security vulnerabilities using static and dynamic techniques.

Community
Advanced