skills.rest
voidrot
voidrotCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sast-configuration

Configure SAST tools like Semgrep, CodeQL, and SonarQube for CI/CD pipelines.

Updated Jul 7, 2026
Search Tags:#ci/cd#security testing#sast#devsecops#static application security testing
One-click install
npx skills add https://github.com/voidrot/agents --skill sast-configuration-voidrot
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-configuration
Source: https://github.com/voidrot/agents/tree/main/skills/security/sast-configuration
Command: npx skills add https://github.com/voidrot/agents --skill sast-configuration-voidrot

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps with selecting, configuring, tuning, or reviewing Static Application Security Testing (SAST) for application code.

Core Features & Use Cases

  • Select and Configure Tools: Choose tools like Semgrep, CodeQL, SonarQube, and configure them for your application code.
  • CI Integration: Set up SAST tools in CI/CD pipelines to run at the right cadence with reproducible versions.
  • Tuning and Rule Management: Tune ignores, baselines, and custom rules with evidence and manage false positives.

Quick Start

Use the sast-configuration skill to configure Semgrep for your codebase.

Frequently Asked Questions about sast-configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure SAST tools like Semgrep or CodeQL for application code?▼

Configure SAST tools for application code by selecting appropriate scanners like Semgrep or CodeQL and applying tool-specific commands and platform settings for automated vulnerability detection.

What is the best way to integrate static application security testing into a CI/CD pipeline?▼

Integrate static application security testing into CI/CD pipelines by configuring scanners to run at the right cadence with reproducible versions, enabling automated code vulnerability detection during builds.

How do I manage false positives and tune custom rules in SAST tools?▼

Manage false positives in SAST tools by tuning ignores, setting baselines, and configuring custom rules with evidence to refine automated vulnerability detection results.

Does SAST configuration support SARIF report output for DevSecOps practices?▼

SAST configuration supports DevSecOps practices by integrating with CI/CD pipelines and generating SARIF report output to standardize automated vulnerability detection findings.

What do I need to set up SonarQube for automated code vulnerability detection?▼

Setting up SonarQube for automated code vulnerability detection requires tool-specific commands and platform settings to configure scanning within your application code environment.

Related Skills

Explore More Software Engineering Skills→
leonardoteodorooleonardoteodoroo

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for CI/CD security scanning.

Community
Advanced
nodnarbnitramnodnarbnitram
15

triage-workflow

Automate SOC II triage from Linear tickets to commits and PRs.

Community
Advanced
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
bugrabilgebugrabilge
10

vulnerability-scanner

Detect security vulnerabilities in code, running apps, and dependencies.

Community
Advanced