skills.rest
robotijn
robotijnCOMMUNITY
Explore all skills by this author →
GitHub

sast-scanner

Scan source code for security vulnerabilities across multiple programming languages.

3|2|Updated Jan 23, 2026
Search Tags:#static analysis#owasp#sast#code security#vulnerability scanning#shift-left#sarif
One-click install
npx skills add https://github.com/robotijn/ctoc --skill sast-scanner-robotijn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-scanner
Source: https://github.com/robotijn/ctoc/tree/main/skills/security/sast-scanner
Command: npx skills add https://github.com/robotijn/ctoc --skill sast-scanner-robotijn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill eliminates the risk of deploying code with undetected security vulnerabilities, which can lead to data breaches, compliance violations, and costly post-release fixes by catching flaws early in the development cycle.

Core Features & Use Cases

  • Multi-language vulnerability detection: Scans Python, C#, JavaScript, Java, C/C++, SQL and other languages for OWASP Top 10, OWASP LLM Top 10, and CWE-classified risks including SQL injection, XSS, broken access control, and prompt injection.
  • Shift-left security integration: Runs in IDEs, pre-commit hooks, and pull request checks to provide real-time feedback to developers as they write code, rather than waiting for post-deployment scans.
  • Prioritized, actionable reporting: Flags vulnerabilities with OWASP tags, CWE IDs, exploit examples, and fixed code snippets, and integrates with CI/CD pipelines via SARIF output for GitHub code scanning. A common use case is scanning a new user authentication endpoint to catch IDOR flaws, hardcoded credentials, and weak cryptography before merging to the main branch.

Quick Start

Use the sast-scanner skill to run a full static security analysis of the current project codebase and return a prioritized report of all critical and high severity vulnerabilities with OWASP tags and remediation guidance.

Frequently Asked Questions about sast-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run static analysis to catch OWASP Top 10 vulnerabilities before merging code?▼

Static analysis scans source code across multiple languages to detect OWASP Top 10 vulnerabilities like SQL injection and XSS. It runs in pull request checks and pre-commit hooks, providing real-time developer feedback with CWE classification tags and fixed code snippets.

Can I generate SARIF output for CI/CD integration from a SAST scan?▼

SAST scans generate SARIF output to integrate with CI/CD pipelines and GitHub code scanning. This format standardizes prioritized vulnerability reporting, enabling automated security checks to block deployments when critical flaws are detected in web applications or APIs.

Does static application security testing work for Python, C#, and JavaScript codebases?▼

Static application security testing supports multi-language vulnerability detection for Python, C#, JavaScript, Java, C/C++, and SQL. It identifies language-specific risks such as broken access control and hardcoded credentials, ensuring comprehensive coverage across diverse project stacks.

What is the best way to detect prompt injection risks in LLM-integrated systems?▼

Detecting prompt injection in LLM-integrated systems requires static analysis targeting the OWASP LLM Top 10. Scanning API integrations and source code identifies LLM-specific vulnerabilities pre-deployment, providing exploit examples and remediation guidance to secure AI workflows.

When do I need shift-left security scanning in the development lifecycle?▼

Shift-left security scanning is needed during IDE development, pre-commit hooks, and pull request reviews. Catching vulnerabilities early in the development cycle eliminates the risk of deploying vulnerable code, preventing data breaches and costly post-release compliance fixes.

Related Skills

Explore More Software Engineering Skills→
statick88statick88
1

security-scanning

Automate security scanning for JavaScript and Python projects.

Community
Advanced
elizaOSelizaOS
19.0k

static-analysis

Run CodeQL and Semgrep scans and parse SARIF results.

Official
Advanced
rnavarychrnavarych
14

security-testing

Automate security testing with Snyk, Semgrep, Gitleaks, and OWASP ZAP in CI/CD pipelines.

Community
Advanced
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced