skills.rest
hardw00t
hardw00tCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sast-orchestration

Orchestrate Semgrep, CodeQL, and Bandit scans across codebases.

90|14|Updated Jan 12, 2026
Search Tags:#CI/CD#reporting#analyze#SAST#Semgrep#CodeQL
One-click install
npx skills add https://github.com/hardw00t/ai-security-arsenal --skill sast-orchestration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-orchestration
Source: https://github.com/hardw00t/ai-security-arsenal/tree/main/skills/sast-orchestration
Command: npx skills add https://github.com/hardw00t/ai-security-arsenal --skill sast-orchestration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill simplifies the coordination of static application security testing across diverse codebases, reducing manual orchestration overhead and ensuring consistent scanning.

Core Features & Use Cases

  • Unified SAST orchestration: Run Semgrep, CodeQL, Bandit, and other tools in a single workflow across multiple languages.
  • Rule development & triage: Create and tune security rules, triage findings, and compare results across tools.
  • CI/CD integration: Seamlessly integrate scans into automated pipelines and generate consolidated reports.

Quick Start

Run the sast_scan.sh script at the root of your project to start parallel scans and then review the aggregated results in the output directory.

Frequently Asked Questions about sast-orchestration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I orchestrate SAST scans across multiple codebases in CI/CD?▼

Run the sast_scan.sh script at your project root to execute parallel SAST scans across multiple languages, aggregate findings from different tools, and generate consolidated reports in the output directory.

Can I compare vulnerability findings between Semgrep and CodeQL?▼

You can compare vulnerability findings between Semgrep and CodeQL by running the orchestration scripts to triage findings, compare results across tools, and unify vulnerability reporting.

Do I need to install Bandit separately to run Python SAST scans?▼

Yes, you need Bandit installed alongside Semgrep and CodeQL, as these are required external tooling for the orchestration scripts to run scans, aggregate results, and generate reports.

What is the best way to unify static application security testing reports from different tools?▼

The best way to unify SAST reports is using orchestration scripts to run multiple tools like Semgrep, CodeQL, and Bandit, aggregate their results, and generate a single consolidated vulnerability report.

How do I write and tune custom Semgrep or CodeQL rules for triage?▼

You write and tune custom Semgrep or CodeQL rules by applying the Skill in multi-language projects to develop security rules, triage findings, and compare results across different SAST tools.

Why are my SAST orchestration scripts not aggregating findings properly?▼

SAST orchestration scripts may fail to aggregate findings if Semgrep, CodeQL, or Bandit tooling is not properly installed or configured in your CI/CD environment before running the sast_scan.sh script.

Related Skills

Explore More Software Engineering Skills→
h4vzzh4vzz
33

static-application-security-testing

Scan source code for security vulnerabilities and generate SARIF reports.

Community
Advanced
jpoleyjpoley
50

security-reporter

Consolidates vulnerability findings into audit reports with risk assessment and compliance mapping.

Community
Advanced
josavicentevwjosavicentevw
1

devsecops

Automate security scanning and governance across CI/CD pipelines and compliance workflows.

Community
Advanced
daishimandaishiman
6

security-reporting

Generate standardized security diagnostic reports from vulnerability findings.

Community
Intermediate