sast-runner

Static application security testing (SAST) scans source code without running it to identify vulnerabilities and security anti-patterns. This Skill automates SAST using Semgrep, which detects issues across multiple languages by applying predefined rulesets like OWASP Top 10 and CWE Top 25, then outputs findings with severity levels and security context.

Yes, this Skill runs Semgrep in CI pipelines to scan repositories automatically. It auto-detects languages, applies relevant security rulesets, and produces JSON or human-readable reports, making it suitable for continuous security monitoring without manual configuration per language.

Semgrep offers multiple predefined rulesets: auto (language-specific detection), security-audit (broad security patterns), owasp-top-ten (OWASP vulnerabilities), cwe-top-25 (common weakness enumeration), and default. This Skill lets you choose the ruleset via the --config flag to match your security requirements.

This Skill runs Semgrep and parses the JSON output into a normalized ScanResult containing findings, metadata, severity levels, CWE/OWASP enrichment, and a summary. Use the --json flag to output machine-readable results for further processing or integration with security tools.

Yes, Semgrep auto-detects programming languages in your repository and applies relevant rules to each file type. This Skill scans the current directory or a specified path, making it suitable for polyglot codebases without separate configuration per language.

This Skill produces both JSON (structured, machine-readable format for tooling integration) and human-readable reports. Use --json for programmatic consumption or the default format for direct review, with findings normalized for consistency across rule types and severity levels.