sast-scanning

Detects source code vulnerabilities via static analysis with JSON/SARIF outputs.

Updated Apr 15, 2026

Search Tags:#static analysis #sast #codeql #sonarqube #semgrep #security gates #ci security

Ready to run

npx skills add https://github.com/ToanPV90/dotfiles --skill sast-scanning-toanpv90

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast-scanning
Source: https://github.com/ToanPV90/dotfiles/tree/main/agents/.agents/skills/sast-scanning
Command: npx skills add https://github.com/ToanPV90/dotfiles --skill sast-scanning-toanpv90

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

SAST scanning identifies security vulnerabilities in source code early, reducing the risk of shipping flawed or exploitable software.

Core Features & Use Cases

Static vulnerability detection across common classes like injection, secrets, and insecure patterns without executing the application.
Tool-supported coverage using Semgrep, CodeQL, SonarQube, plus language-focused options like Bandit (Python), ESLint security (JavaScript), and Brakeman (Ruby).
Security gate readiness by producing machine-consumable outputs (JSON/SARIF) and supporting CI workflows for PR/commit enforcement.
Use Case: Add security checks to every pull request so high/critical findings block merges until fixed.

Quick Start

Run this skill by telling your AI to execute a Semgrep scan on the current repository with auto-configured rules: semgrep --config auto ..

Frequently Asked Questions about sast-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add SAST scanning to pull requests so vulnerabilities block merges?▼

SAST scanning enforces security gates in CI/CD by producing machine-consumable outputs like JSON or SARIF. You can configure PR workflows to block merges until high or critical static analysis findings are fixed.

What's the best way to detect code vulnerabilities without executing the application?▼

Static application security testing detects vulnerabilities in source code without executing the application. It identifies common insecure patterns like injection flaws and hardcoded secrets early in the SDLC.

Can I use Semgrep, CodeQL, and SonarQube together for static code analysis?▼

Yes, this approach supports tool coverage using Semgrep, CodeQL, and SonarQube. It also integrates language-focused options like Bandit, ESLint security, and Brakeman for broader vulnerability detection.

How do I run a Semgrep scan with auto-configured rules on my repository?▼

Run a Semgrep scan with auto-configured rules by executing the command `semgrep --config auto .` in your repository directory. This initiates static analysis to detect security vulnerabilities.

Does SAST scanning support SARIF output for CI security workflows?▼

Yes, SAST scanning produces machine-consumable outputs including JSON and SARIF formats. This ensures security gate readiness and supports automated CI workflows for commit enforcement.