Sast Configuration
Unverified●32/40Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add sast-configurationWho is stuck, and on what
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
The whole source
Frontmatter — 2 properties
| name | sast-configuration |
|---|---|
| description | Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection. |
| 1 | --- |
| 2 | name: sast-configuration |
| 3 | description: Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection. |
| 4 | ---A5 — No allowed-tools declared — no way to tell what this skill may touch |
| 5 | |
| 6 | # SAST Configuration |
| 7 | |
| 8 | Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages. |
| 9 | |
| 10 | ## Overview |
| 11 | |
| 12 | This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. Use this skill when you need to: |
| 13 | |
| 14 | - Set up SAST scanning in CI/CD pipelines |
| 15 | - Create custom security rules for your codebase |
| 16 | - Configure quality gates and compliance policies |
| 17 | - Optimize scan performance and reduce false positives |
| 18 | - Integrate multiple SAST tools for defense-in-depth |
| 19 | |
| 20 | ## Core Capabilities |
| 21 | |
| 22 | ### 1. Semgrep Configuration |
| 23 | |
| 24 | - Custom rule creation with pattern matching |
| 25 | - Language-specific security rules (Python, JavaScript, Go, Java, etc.) |
| 26 | - CI/CD integration (GitHub Actions, GitLab CI, Jenkins) |
| 27 | - False positive tuning and rule optimization |
| 28 | - Organizational policy enforcement |
| 29 | |
| 30 | ### 2. SonarQube Setup |
| 31 | |
| 32 | - Quality gate configuration |
| 33 | - Security hotspot analysis |
| 34 | - Code coverage and technical debt tracking |
| 35 | - Custom quality profiles for languages |
| 36 | - Enterprise integration with LDAP/SAML |
| 37 | |
| 38 | ### 3. CodeQL Analysis |
| 39 | |
| 40 | - GitHub Advanced Security integration |
| 41 | - Custom query development |
| 42 | - Vulnerability variant analysis |
| 43 | - Security research workflows |
| 44 | - SARIF result processing |
| 45 | |
| 46 | ## Quick Start |
| 47 | |
| 48 | ### Initial Assessment |
| 49 | |
| 50 | 1. Identify primary programming languages in your codebase |
| 51 | 2. Determine compliance requirements (PCI-DSS, SOC 2, etc.) |
| 52 | 3. Choose SAST tool based on language support and integration needs |
| 53 | 4. Review baseline scan to understand current security posture |
| 54 | |
| 55 | ### Basic Setup |
| 56 | |
| 57 | ```bash |
| 58 | # Semgrep quick start |
| 59 | pip install semgrep |
| 60 | semgrep --config=auto --error |
| 61 | |
| 62 | # SonarQube with Docker |
| 63 | docker run -d --name sonarqube -p 9000:9000 sonarqube:10.8-community |
| 64 | |
| 65 | # CodeQL CLI setup |
| 66 | gh extension install github/gh-codeql |
| 67 | codeql database create mydb --language=python |
| 68 | ``` |
| 69 | |
| 70 | ## Integration Patterns |
| 71 | |
| 72 | ### CI/CD Pipeline Integration |
| 73 | |
| 74 | ```yaml |
| 75 | # GitHub Actions example |
| 76 | - name: Run Semgrep |
| 77 | uses: returntocorp/semgrep-action@v1 |
| 78 | with: |
| 79 | config: >- |
| 80 | p/security-audit |
| 81 | p/owasp-top-ten |
| 82 | ``` |
| 83 | |
| 84 | ### Pre-commit Hook |
| 85 | |
| 86 | ```bash |
| 87 | # .pre-commit-config.yaml |
| 88 | - repo: https://github.com/returntocorp/semgrep |
| 89 | rev: v1.45.0 |
| 90 | hooks: |
| 91 | - id: semgrep |
| 92 | args: ['--config=auto', '--error'] |
| 93 | ``` |
| 94 | |
| 95 | ## Best Practices |
| 96 | |
| 97 | 1. **Start with Baseline** |
| 98 | - Run initial scan to establish security baseline |
| 99 | - Prioritize critical and high severity findings |
| 100 | - Create remediation roadmap |
| 101 | |
| 102 | 2. **Incremental Adoption** |
| 103 | - Begin with security-focused rules |
| 104 | - Gradually add code quality rules |
| 105 | - Implement blocking only for critical issues |
| 106 | |
| 107 | 3. **False Positive Management** |
| 108 | - Document legitimate suppressions |
| 109 | - Create allow lists for known safe patterns |
| 110 | - Regularly review suppressed findings |
| 111 | |
| 112 | 4. **Performance Optimization** |
| 113 | - Exclude test files and generated code |
| 114 | - Use incremental scanning for large codebases |
| 115 | - Cache scan results in CI/CD |
| 116 | |
| 117 | 5. **Team Enablement** |
| 118 | - Provide security training for developers |
| 119 | - Create internal documentation for common patterns |
| 120 | - Establish security champions program |
| 121 | |
| 122 | ## Common Use Cases |
| 123 | |
| 124 | ### New Project Setup |
| 125 | |
| 126 | ```bash |
| 127 | ./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube |
| 128 | ``` |
| 129 | |
| 130 | ### Custom Rule Development |
| 131 | |
| 132 | ```yaml |
| 133 | # See references/semgrep-rules.md for detailed examples |
| 134 | rules: |
| 135 | - id: hardcoded-jwt-secret |
| 136 | pattern: jwt.encode($DATA, "...", ...) |
| 137 | message: JWT secret should not be hardcoded |
| 138 | severity: ERROR |
| 139 | ``` |
| 140 | |
| 141 | ### Compliance Scanning |
| 142 | |
| 143 | ```bash |
| 144 | # PCI-DSS focused scan |
| 145 | semgrep --config p/pci-dss --json -o pci-scan-results.json |
| 146 | ``` |
| 147 | |
| 148 | ## Troubleshooting |
| 149 | |
| 150 | ### High False Positive Rate |
| 151 | |
| 152 | - Review and tune rule sensitivity |
| 153 | - Add path filters to exclude test files |
| 154 | - Use nostmt metadata for noisy patterns |
| 155 | - Create organization-specific rule exceptions |
| 156 | |
| 157 | ### Performance Issues |
| 158 | |
| 159 | - Enable incremental scanning |
| 160 | - Parallelize scans across modules |
| 161 | - Optimize rule patterns for efficiency |
| 162 | - Cache dependencies and scan results |
| 163 | |
| 164 | ### Integration Failures |
| 165 | |
| 166 | - Verify API tokens and credentials |
| 167 | - Check network connectivity and proxy settings |
| 168 | - Review SARIF output format compatibility |
| 169 | - Validate CI/CD runner permissions |
| 170 | |
| 171 | ## Related Skills |
| 172 | |
| 173 | - [OWASP Top 10 Checklist](../owasp-top10-checklist/SKILL.md) |
| 174 | - [Container Security](../container-security/SKILL.md) |
| 175 | - [Dependency Scanning](../dependency-scanning/SKILL.md) |
| 176 | |
| 177 | ## Tool Comparison |
| 178 | |
| 179 | | Tool | Best For | Language Support | Cost | Integration | |
| 180 | | --------- | ------------------------ | ---------------- | --------------- | ------------- | |
| 181 | | Semgrep | Custom rules, fast scans | 30+ languages | Free/Enterprise | Excellent | |
| 182 | | SonarQube | Code quality + security | 25+ languages | Free/Commercial | Good | |
| 183 | | CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native | |
| 184 | |
| 185 | ## Next Steps |
| 186 | |
| 187 | 1. Complete initial SAST tool setup |
| 188 | 2. Run baseline security scan |
| 189 | 3. Create custom rules for organization-specific patterns |
| 190 | 4. Integrate into CI/CD pipeline |
| 191 | 5. Establish security gate policies |
| 192 | 6. Train development team on findings and remediation |
| 193 |
Reviews
Installed this one?Write the first review and take the Trailblazer badge.
Alternatives
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.◐····●35/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.◐◐◐◐◐●31/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.◐◐◐◐◐●30/40Protocol Reverse EngineeringMaster network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.◐····●30/40