sast-scanning

Identify security vulnerabilities in source code through static analysis.

Updated Aug 23, 2026

Search Tags:#sast #ci-cd #code-analysis #codeql #sonarqube #semgrep #security-testing

Ready to run

npx skills add https://github.com/tylern91/dotfiles --skill sast-scanning-tylern91

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast-scanning
Source: https://github.com/tylern91/dotfiles/tree/main/agents/.agents/skills/sast-scanning
Command: npx skills add https://github.com/tylern91/dotfiles --skill sast-scanning-tylern91

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Identify security vulnerabilities in source code through static analysis.

Core Features & Use Cases

SAST tooling integration with Semgrep, CodeQL, and SonarQube to identify vulnerabilities early
Supports secure SDLC practices, code reviews, and CI/CD gates to enforce security checks
Use case: integrate scans into PR workflows to block or gate insecure changes

Quick Start

Run a quick scan of your repository with Semgrep by executing semgrep --config auto . in the project root.

Frequently Asked Questions about sast-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I integrate static analysis to find security vulnerabilities in source code?▼

Static analysis identifies security vulnerabilities in source code by integrating SAST tooling like Semgrep, CodeQL, or SonarQube into secure SDLC practices, code reviews, and CI pipelines to catch issues before deployment.

What is the best way to set up SAST scanning in a CI/CD pipeline?▼

Set up SAST scanning in a CI/CD pipeline by configuring tools like Semgrep, CodeQL, or SonarQube to run automatically on code changes, enforcing security gates to block insecure pull requests from merging.

Do I need to install Semgrep or CodeQL before scanning my repository?▼

Yes, you need to install SAST tooling such as Semgrep, CodeQL, or SonarQube and have access to the repository to run static analysis scans and identify security flaws in the source code.

How do I run a quick Semgrep scan on my project?▼

Run a quick Semgrep scan by executing the command `semgrep --config auto .` in your project root directory to identify security vulnerabilities in the source code without complex configuration.

Can I use static analysis to gate insecure code changes in pull requests?▼

Yes, static analysis supports secure SDLC practices by integrating scans into pull request workflows to block or gate insecure code changes before they are merged into the main repository.

What are the limitations of running SAST scans across diverse projects?▼

SAST scans require proper installation of analysis tools like Semgrep or SonarQube and repository access, meaning limitations arise if environment setup is incomplete or access is restricted across diverse project environments.