Scan multi-language codebases with local Semgrep rules for security weaknesses.
npx skills add https://github.com/Q16G/aster --skill sast-scan
Please help me install this Agent Skill. Skill: sast-scan Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/sast-scan Command: npx skills add https://github.com/Q16G/aster --skill sast-scan
Static security scanning across multiple languages using local Semgrep rules to identify common vulnerabilities (RCE, SQLi, XSS, XXE, SSRF, command injection, unsafe deserialization, path traversal) in source, XML config, and template files, returning structured results for prioritization.
To start a local SAST scan, run the skill against a project directory with the appropriate language hint and review the categorized findings.
High-intent search queries and answers about installing and using this skill.
You can run a local static analysis scan on Java, Go, Python, JavaScript, PHP, and C/C++ projects by using embedded Semgrep rules to automatically detect project signals and assemble a comprehensive scan surface.
Local SAST rules detect common security vulnerabilities including RCE, SQL injection, XSS, XXE, SSRF, command injection, unsafe deserialization, and path traversal across source, XML config, and template files.
No, this local SAST tool uses locally embedded Semgrep rules and requires no online config or external dependencies, enabling language-agnostic scanning and structured output without external connectivity.
SAST findings are categorized into three structured buckets: high_confidence, needs_dataflow_confirmation, and high_noise patterns, which support subsequent dataflow analysis and business logic review for remediation.
Yes, you can use the embedded Semgrep rules to scan source, XML config, and template files across multiple languages, returning structured results for prioritization and identifying security weaknesses.
The best way to identify path traversal and unsafe deserialization is by performing local, rule-based SAST using embedded Semgrep rules, which automatically generate a scan surface for comprehensive multi-language detection.
chenchunrunAudit source code for security vulnerabilities and generate risk-rated CWE reports.
chaigonAudit Python, Node.js, Go, and Java code for OWASP Top 10 vulnerabilities.
duanbiao2000Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
iiammaeRun Semgrep static analysis scans to identify security vulnerabilities and bugs.
