skills.rest
Rune-kit
Rune-kitOFFICIAL
Explore all skills by this author →
GitHub

sast

Run static analysis tools and normalize findings into unified severity levels.

82|23|Updated Feb 24, 2026
Search Tags:#code analysis#security#vulnerability#eslint#sast#bandit#semgrep
One-click install
npx skills add https://github.com/Rune-kit/rune --skill sast-rune-kit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast
Source: https://github.com/Rune-kit/rune/tree/main/skills/sast
Command: npx skills add https://github.com/Rune-kit/rune --skill sast-rune-kit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the need for in-depth code security analysis that goes beyond simple pattern matching, identifying subtle vulnerabilities like data flow issues and unsafe deserialization.

Core Features & Use Cases

  • Unified Static Analysis: Wraps multiple tools (ESLint, Semgrep, Bandit, Clippy, etc.) for comprehensive code scanning.
  • Language Agnostic: Detects project language and runs appropriate analyzers.
  • Vulnerability Detection: Catches complex security flaws missed by basic linters.
  • Use Case: Before deploying a new authentication module, run SAST to ensure no subtle injection vulnerabilities or insecure data handling practices are present.

Quick Start

Run a static analysis scan on the current project to identify security vulnerabilities.

Frequently Asked Questions about sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis to detect security vulnerabilities in my code?▼

Static analysis detects security vulnerabilities by executing a suite of analyzers like ESLint, Semgrep, Bandit, and Clippy. It automatically identifies the project language, runs the appropriate tools, and normalizes findings into unified severity levels.

Can I use Semgrep and Bandit together for code security analysis?▼

Yes, you can use Semgrep and Bandit together for code security analysis. This approach wraps multiple static analyzers to provide comprehensive scanning, catching complex security flaws like data flow issues and unsafe deserialization that basic linters miss.

What is the best way to check for insecure data handling before deployment?▼

The best way to check for insecure data handling is running deep static analysis before deployment. This scans the codebase using language-specific analyzers to identify subtle injection vulnerabilities and normalizes the results into actionable severity reports.

Does static analysis work automatically for multi-language projects?▼

Static analysis works automatically for multi-language projects by detecting the project language and running the appropriate analyzers. It wraps language-specific tools to ensure comprehensive code scanning without requiring manual configuration.

How are code security scan results categorized for triage?▼

Code security scan results are categorized by normalizing findings from all executed tools into unified severity levels: BLOCK, WARN, and INFO. This normalization provides detailed reports on tool coverage and detected issues for efficient triage.

Related Skills

Explore More Software Engineering Skills→
baphledbaphled
1

static-analysis

Guide static code analysis tools to detect bugs, vulnerabilities, and style violations.

Community
Intermediate
jeremylongshorejeremylongshore
2.6k

scanning-for-vulnerabilities

Scan codebases, dependencies, and configurations for security vulnerabilities and CVEs.

Community
Intermediate
bugrabilgebugrabilge
10

vulnerability-scanner

Detect security vulnerabilities in code, running apps, and dependencies.

Community
Advanced
rohanbhatia27rohanbhatia27
1

semgrep-rule-creator

Automate creation of Semgrep rules for security vulnerabilities and code patterns.

Community
Intermediate