skills.rest
ToanPV90
ToanPV90COMMUNITY
Explore all skills by this author →
GitHub

sast-scanning

Detects source code vulnerabilities via static analysis with JSON/SARIF outputs.

Updated Apr 15, 2026
Search Tags:#static analysis#sast#codeql#sonarqube#semgrep#security gates#ci security
One-click install
npx skills add https://github.com/ToanPV90/dotfiles --skill sast-scanning-toanpv90
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-scanning
Source: https://github.com/ToanPV90/dotfiles/tree/main/agents/.agents/skills/sast-scanning
Command: npx skills add https://github.com/ToanPV90/dotfiles --skill sast-scanning-toanpv90

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

SAST scanning identifies security vulnerabilities in source code early, reducing the risk of shipping flawed or exploitable software.

Core Features & Use Cases

  • Static vulnerability detection across common classes like injection, secrets, and insecure patterns without executing the application.
  • Tool-supported coverage using Semgrep, CodeQL, SonarQube, plus language-focused options like Bandit (Python), ESLint security (JavaScript), and Brakeman (Ruby).
  • Security gate readiness by producing machine-consumable outputs (JSON/SARIF) and supporting CI workflows for PR/commit enforcement.
  • Use Case: Add security checks to every pull request so high/critical findings block merges until fixed.

Quick Start

Run this skill by telling your AI to execute a Semgrep scan on the current repository with auto-configured rules: semgrep --config auto ..

Frequently Asked Questions about sast-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add SAST scanning to pull requests so vulnerabilities block merges?▼

SAST scanning enforces security gates in CI/CD by producing machine-consumable outputs like JSON or SARIF. You can configure PR workflows to block merges until high or critical static analysis findings are fixed.

What's the best way to detect code vulnerabilities without executing the application?▼

Static application security testing detects vulnerabilities in source code without executing the application. It identifies common insecure patterns like injection flaws and hardcoded secrets early in the SDLC.

Can I use Semgrep, CodeQL, and SonarQube together for static code analysis?▼

Yes, this approach supports tool coverage using Semgrep, CodeQL, and SonarQube. It also integrates language-focused options like Bandit, ESLint security, and Brakeman for broader vulnerability detection.

How do I run a Semgrep scan with auto-configured rules on my repository?▼

Run a Semgrep scan with auto-configured rules by executing the command `semgrep --config auto .` in your repository directory. This initiates static analysis to detect security vulnerabilities.

Does SAST scanning support SARIF output for CI security workflows?▼

Yes, SAST scanning produces machine-consumable outputs including JSON and SARIF formats. This ensures security gate readiness and supports automated CI workflows for commit enforcement.

Related Skills

Explore More Software Engineering Skills→
brenordvbrenordv

security

Audit software systems for security vulnerabilities and regulatory compliance.

Community
Advanced
igbuendigbuend
8

sarif-issue-reporter

Analyze SARIF 2.1.0 files to generate vulnerability reports with CVSS scoring.

Community
Advanced
Rune-kitRune-kit
82

sast

Run static analysis tools and normalize findings into unified severity levels.

Official
Advanced
Ed1s0nZEd1s0nZ
5.6k

mobile-app-security-testing

Analyze Android and iOS applications for security vulnerabilities using static and dynamic techniques.

Community
Advanced