security-scanning-security-sast
This skill performs static analysis to find security vulnerabilities and patterns in multi-language codebases.
Install
mkdir -p .claude/skills/security-scanning-security-sast && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/6829" && unzip -o skill.zip -d .claude/skills/security-scanning-security-sast && rm skill.zipInstalls to .claude/skills/security-scanning-security-sast
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Static Application Security Testing (SAST) for code vulnerabilityKey capabilities
- →Integrate multi-language scanning tools
- →Identify SQL injection and XSS patterns
- →Detect hardcoded credentials
- →Analyze framework-specific security misconfigurations
- →Develop custom Semgrep rules
How it works
Performs static analysis by matching code patterns against established vulnerability databases and security-policy definitions.
Inputs & outputs
When to use security-scanning-security-sast
- →Detect SQL injection and XSS vulnerabilities
- →Scan for hardcoded credentials
- →Verify compliance with security patterns
- →Check framework-specific security settings
About this skill
SAST Security Plugin
Static Application Security Testing (SAST) for comprehensive code vulnerability detection across multiple languages, frameworks, and security patterns.
Detailed Guide
Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.
Use this skill when
Use for code review security analysis, injection vulnerabilities, hardcoded secrets, framework-specific patterns, custom security policy enforcement, pre-deployment validation, legacy code assessment, and compliance (OWASP, PCI-DSS, SOC2).
Specialized tools: Use security-secrets.md for advanced credential scanning, security-owasp.md for Top 10 mapping, security-api.md for REST/GraphQL endpoints.
Do not use this skill when
- You only need runtime testing or penetration testing
- You cannot access the source code or build outputs
- The environment forbids third-party scanning tools
Safety
- Avoid uploading proprietary code to external services without approval.
- Require review before enabling auto-fix or blocking releases.
Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
When not to use it
- →Dynamic/Runtime penetration testing
- →Environments without access to source code
Prerequisites
Limitations
- →Prone to false positives in complex logic
- →Limited by the scope of configured rules
How it compares
It provides automated, repeatable pre-deployment verification instead of manual code review.
Compared to similar skills
security-scanning-security-sast side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-scanning-security-sast (this skill) | 2 | 5mo | Review | Intermediate |
| security-audit | 3 | 7mo | Review | Intermediate |
| codex-code-review | 1 | 9mo | Review | Intermediate |
| moai-foundation-quality | 0 | 4mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by sickn33
View all by sickn33 →You might also like
security-audit
ruvnet
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.
codex-code-review
tyrchen
Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.
moai-foundation-quality
modu-ai
Enterprise code quality orchestrator with TRUST 5 validation, proactive analysis, and automated best practices enforcement
data-validation-schemas
Harmitx7
Data validation and schema design mastery. Zod, Yup, Joi, Valibot, and Pydantic schema design, runtime type checking, API boundary validation, form validation patterns, DTO design, schema composition, error message formatting, schema evolution strategies, and coercion rules. Use when validating user
verification-loop
tom237ttkk
A comprehensive verification system for Codex work sessions.
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.