sast

Name: sast
Availability: InStock
Author: Rune-kit

Run static analysis tools and normalize findings into unified severity levels.

82|23|Updated Feb 24, 2026

Search Tags:#code analysis #security #vulnerability #eslint #sast #bandit #semgrep

Ready to run

npx skills add https://github.com/Rune-kit/rune --skill sast-rune-kit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast
Source: https://github.com/Rune-kit/rune/tree/main/skills/sast
Command: npx skills add https://github.com/Rune-kit/rune --skill sast-rune-kit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the need for in-depth code security analysis that goes beyond simple pattern matching, identifying subtle vulnerabilities like data flow issues and unsafe deserialization.

Core Features & Use Cases

Unified Static Analysis: Wraps multiple tools (ESLint, Semgrep, Bandit, Clippy, etc.) for comprehensive code scanning.
Language Agnostic: Detects project language and runs appropriate analyzers.
Vulnerability Detection: Catches complex security flaws missed by basic linters.
Use Case: Before deploying a new authentication module, run SAST to ensure no subtle injection vulnerabilities or insecure data handling practices are present.

Quick Start

Run a static analysis scan on the current project to identify security vulnerabilities.

Frequently Asked Questions about sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run static analysis to detect security vulnerabilities in my code?▼

Static analysis detects security vulnerabilities by executing a suite of analyzers like ESLint, Semgrep, Bandit, and Clippy. It automatically identifies the project language, runs the appropriate tools, and normalizes findings into unified severity levels.

Can I use Semgrep and Bandit together for code security analysis?▼

Yes, you can use Semgrep and Bandit together for code security analysis. This approach wraps multiple static analyzers to provide comprehensive scanning, catching complex security flaws like data flow issues and unsafe deserialization that basic linters miss.

What is the best way to check for insecure data handling before deployment?▼

The best way to check for insecure data handling is running deep static analysis before deployment. This scans the codebase using language-specific analyzers to identify subtle injection vulnerabilities and normalizes the results into actionable severity reports.

Does static analysis work automatically for multi-language projects?▼

Static analysis works automatically for multi-language projects by detecting the project language and running the appropriate analyzers. It wraps language-specific tools to ensure comprehensive code scanning without requiring manual configuration.

How are code security scan results categorized for triage?▼

Code security scan results are categorized by normalizing findings from all executed tools into unified severity levels: BLOCK, WARN, and INFO. This normalization provides detailed reports on tool coverage and detected issues for efficient triage.