Agent skill · security · aiskillstore
sast-configuration
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
Why this skill is useful
Adds executable scripts for SAST execution and custom rule creation that enhance security scanning capabilities beyond standard practices.
What it needs
Requires docker, semgrep installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
SAST Configuration Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages. Overview This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. Use this skill when you need to: Set up SAST scanning in CI/CD pipelines Create custom security rules for your codebase Configure quality gates and compliance policies Optimize scan performance and reduce false positives Integrate multiple SAST tools for defense-in-depth Core Capabilities 1. Semgrep Configuration Custom rule creation with pattern matching Language-specific security rules (Python, JavaScript, Go, Java, etc.) CI/CD integration (GitHub Actions, GitLab CI, Jenkins) False positive tuning and rule optimization Organizational policy enforcement 2. SonarQube Setup Quality gate configuration Security hotspot analysis Code coverage and technical debt tracking Custom quality profiles for languages Enterprise integration with LDAP/SAML 3. CodeQL Analysis GitHub Advanced Security integration Custom query development Vulnerability variant analysis Security research workflows SARIF result processing Quick Start Initial Assessment 1. Identify primary programming languages in your codebase 2. Determine compliance requirements (PCI-DSS, SOC 2, etc.) 3. Choose SAST tool based on language support and integration needs 4. Review baseline scan to understand current security posture Basic Setup Reference Documentation Semgrep Rule Creation - Pattern-based security rule development SonarQube Configuration - Quality gates and profiles CodeQL Setup Guide - Query development and workflows Templates & Assets semgrep-config.yml - Production-ready Semgrep configuration sonarqube-settings.xml - SonarQube quality profile template run-sast.sh - Automated SAST execution script Integration Patterns CI/CD Pipeline Integration Pre-commit Hook Best Practices 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/sast-configuration--9eb631