skills.rest
tylern91
tylern91COMMUNITY
Explore all skills by this author →
WebsiteGitHub

sast-scanning

Identify security vulnerabilities in source code through static analysis.

Updated Aug 23, 2026
Search Tags:#sast#ci-cd#code-analysis#codeql#sonarqube#semgrep#security-testing
One-click install
npx skills add https://github.com/tylern91/dotfiles --skill sast-scanning-tylern91
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-scanning
Source: https://github.com/tylern91/dotfiles/tree/main/agents/.agents/skills/sast-scanning
Command: npx skills add https://github.com/tylern91/dotfiles --skill sast-scanning-tylern91

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Identify security vulnerabilities in source code through static analysis.

Core Features & Use Cases

  • SAST tooling integration with Semgrep, CodeQL, and SonarQube to identify vulnerabilities early
  • Supports secure SDLC practices, code reviews, and CI/CD gates to enforce security checks
  • Use case: integrate scans into PR workflows to block or gate insecure changes

Quick Start

Run a quick scan of your repository with Semgrep by executing semgrep --config auto . in the project root.

Frequently Asked Questions about sast-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate static analysis to find security vulnerabilities in source code?▼

Static analysis identifies security vulnerabilities in source code by integrating SAST tooling like Semgrep, CodeQL, or SonarQube into secure SDLC practices, code reviews, and CI pipelines to catch issues before deployment.

What is the best way to set up SAST scanning in a CI/CD pipeline?▼

Set up SAST scanning in a CI/CD pipeline by configuring tools like Semgrep, CodeQL, or SonarQube to run automatically on code changes, enforcing security gates to block insecure pull requests from merging.

Do I need to install Semgrep or CodeQL before scanning my repository?▼

Yes, you need to install SAST tooling such as Semgrep, CodeQL, or SonarQube and have access to the repository to run static analysis scans and identify security flaws in the source code.

How do I run a quick Semgrep scan on my project?▼

Run a quick Semgrep scan by executing the command `semgrep --config auto .` in your project root directory to identify security vulnerabilities in the source code without complex configuration.

Can I use static analysis to gate insecure code changes in pull requests?▼

Yes, static analysis supports secure SDLC practices by integrating scans into pull request workflows to block or gate insecure code changes before they are merged into the main repository.

What are the limitations of running SAST scans across diverse projects?▼

SAST scans require proper installation of analysis tools like Semgrep or SonarQube and repository access, meaning limitations arise if environment setup is incomplete or access is restricted across diverse project environments.

Related Skills

Explore More Software Engineering Skills→
emilneuraz-aiemilneuraz-ai

sast-configuration

Configure Semgrep, SonarQube, and CodeQL security scanning in CI/CD pipelines.

Community
Advanced
ToanPV90ToanPV90

sast-scanning

Detects source code vulnerabilities via static analysis with JSON/SARIF outputs.

Community
Advanced
endorlabsendorlabs
2

endor-review

Automate pre-PR security reviews by scanning changed files for vulnerabilities, secrets, licenses, and compliance issues.

Official
Advanced
DevHive1DevHive1
18

security_scan

Orchestrate dependency, static analysis, and privacy dataflow scanners into prioritized reports.

Community
Advanced