skills.rest
lauhon
lauhonCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

static-analysis

Query Datadog SAST and SCA findings to track code vulnerabilities and dependency risks.

5|2|Updated Mar 9, 2026
Search Tags:#static analysis#sast#code security#vulnerability management#datadog#sca#dependency scanning
One-click install
npx skills add https://github.com/lauhon/pi --skill static-analysis-lauhon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: static-analysis
Source: https://github.com/lauhon/pi/tree/main/skills/static-analysis
Command: npx skills add https://github.com/lauhon/pi --skill static-analysis-lauhon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security and engineering teams struggle to get a consolidated view of code vulnerabilities and dependency risks across repositories. This Skill lets you query Datadog Code Security signals (SAST and SCA findings) directly through the pup CLI, so you can triage vulnerabilities, prioritize remediation, and monitor dependency health without manually navigating dashboards. ## Core Features & Use Cases - SAST Findings Query: Search static analysis results for SQL injection, XSS, hardcoded secrets, and other code-level vulnerabilities filtered by severity, repository, or rule. - SCA Dependency Tracking: Identify vulnerable open-source libraries with CVE details, CVSS scores, EPSS exploitation probability, and concrete upgrade paths. - Severity-Based Triage: Filter code security signals by criticality, environment, or service to focus remediation on production-impacting issues. - Use Case: Ask "What are my critical security issues this week?" and receive a prioritized breakdown of SAST and SCA findings with affected files, libraries, and recommended fixes. ## Quick Start Ask the agent to show all critical code security vulnerabilities from the last 7 days across your repositories.

Frequently Asked Questions about static-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Datadog code security vulnerabilities from the CLI?▼

Use the pup CLI with the security signals command and filter by source:code_security. You can narrow results by severity, vulnerability type (SAST or SCA), repository, or time range using query attributes like @vulnerability.type:sast or status:critical.

What is the difference between SAST and SCA findings in Datadog?▼

SAST findings are vulnerabilities and code quality issues detected in your own source code, such as SQL injection or hardcoded secrets. SCA findings are known CVEs and risks in third-party open-source dependencies, including CVSS scores and upgrade paths.

Which languages and package managers does Datadog static analysis support?▼

SAST supports 14+ languages including Python, JavaScript, Java, Go, Ruby, PHP, and C#. SCA covers package managers such as Maven, npm, pip, Go modules, Bundler, Composer, NuGet, Cargo, and Swift Package Manager.

Can I run SAST or SCA scans through this Skill?▼

No, running scans is a write operation not available through the API. Scans are executed with the datadog-ci CLI in CI/CD pipelines, while this Skill only queries and reads existing code security findings.

Why do I get a permission error when querying code security data?▼

The error occurs when the DD_APP_KEY lacks the code_analysis_read scope or credentials are missing. Set DD_API_KEY, DD_APP_KEY, and DD_SITE environment variables, and confirm Code Security is enabled in your Datadog organization.

Related Skills

Explore More Software Engineering Skills→
psmfdpsmfd

checkmarx-expert

Provides Checkmarx One CLI reference for SAST, SCA, IaC, and secrets scanning workflows.

Official
Intermediate
xalgordxalgord
954

building-devsecops-pipeline-with-gitlab-ci

Configure a GitLab CI/CD pipeline integrating SAST, DAST, container, dependency, and secret scanning.

Community
Intermediate
nimadorostkarnimadorostkar
25

security-review

Trace untrusted data and verify authorization logic to identify security vulnerabilities.

Community
Advanced
xtrm-devxtrm-dev
4

security-pipeline

Bootstrap a GitHub security pipeline with secret scanning, SAST, and dependency checks.

Official
Advanced