skills.rest
MeoBaka
MeoBakaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-scanning-security-sast

Identify security weaknesses in source code using automated SAST tooling.

Updated Aug 23, 2026
Search Tags:#security#owasp#sast#ci-cd#code-analysis#bandit#semgrep
One-click install
npx skills add https://github.com/MeoBaka/MeoPanel-Client --skill security-scanning-security-sast
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scanning-security-sast
Source: https://github.com/MeoBaka/MeoPanel-Client/tree/main/.claude/skills/security-scanning-security-sast
Command: npx skills add https://github.com/MeoBaka/MeoPanel-Client --skill security-scanning-security-sast

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify security vulnerabilities in source code across multiple languages using automated SAST tooling.

Core Features & Use Cases

  • Multi-language SAST coverage for Python, JavaScript/TypeScript, Java, Ruby, Go, and Rust
  • Tool integration with Semgrep, Bandit, ESLint Security, SonarQube, CodeQL, PMD, SpotBugs, Brakeman, gosec, cargo-clippy
  • Vulnerability patterns: SQL injection, XSS, hardcoded secrets, path traversal, IDOR, CSRF, insecure deserialization
  • Framework analysis: Django, Flask, React, Express, Spring Boot, Rails, Laravel
  • Custom rule authoring: Semgrep pattern development for organization-specific security policies

Quick Start

Scan your repository with the configured SAST tools to surface vulnerabilities and policy violations.

Frequently Asked Questions about security-scanning-security-sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run SAST code analysis to detect vulnerabilities across a multi-language repository?▼

Multi-language SAST code analysis detects vulnerabilities across Python, JavaScript, Java, Ruby, Go, and Rust by applying automated tooling like Semgrep and Bandit to repository-wide codebases, outputting structured security findings.

Can I use Semgrep and Bandit to scan for SQL injection and XSS in framework-specific code?▼

Yes, Semgrep and Bandit scan framework-specific code in Django, Flask, React, and Spring Boot to detect vulnerability patterns including SQL injection, XSS, hardcoded secrets, path traversal, and insecure deserialization.

What is the best way to integrate static application security testing into a CI pipeline?▼

Integrating static application security testing into CI pipelines involves running configurable SAST rule sets across your repository codebase to automatically surface policy violations and security weaknesses as structured outputs.

Does this SAST tooling support custom rule authoring for organization-specific security policies?▼

Yes, custom rule authoring is supported through Semgrep pattern development, allowing you to define and enforce organization-specific security policies during automated source code vulnerability analysis.

How do I find hardcoded secrets and IDOR vulnerabilities in source code automatically?▼

Automated SAST tooling identifies hardcoded secrets, IDOR, and CSRF vulnerabilities by scanning source code with configurable rule sets across multiple languages and frameworks like Rails and Express.

What are the limitations of using SAST tools for repository-wide security audits?▼

SAST tools for repository-wide security audits require configurable rule sets and standard integrations like SonarQube or CodeQL, focusing on identifying code-level weaknesses rather than runtime application behavior.

Related Skills

Explore More Software Engineering Skills→
camoneartcamoneart
5

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection in CI/CD pipelines.

Community
Advanced
Blake-JohnBlake-John

security-reviewer

Identify security vulnerabilities and generate structured audit reports with severity ratings.

Community
Advanced
rnavarychrnavarych
14

security-testing

Automate security testing with Snyk, Semgrep, Gitleaks, and OWASP ZAP in CI/CD pipelines.

Community
Advanced
georgekhananaevgeorgekhananaev
27

code-quality

Enforce cross-language code quality standards across TypeScript, Python, Go, and Rust.

Community
Advanced