Agent skill · security · aiskillstore
sast-horusec
Multi-language static application security testing using Horusec with support for 18+ programming languages and 20+ security analysis tools. Performs SAST scans, secret detection in git history, and provides vulnerability findings with severity classification. Use when: (1) Analyzing code for security vulnerabilities across multiple languages simultaneously, (2) Detecting exposed secrets and credentials in git history, (3) Integrating SAST into CI/CD pipelines for secure SDLC, (4) Performing comprehensive security analysis during development, (5) Managing false positives and prioritizing security findings.
Why this skill is useful
Adds executable scripts for multi-language static application security testing and integrates into CI/CD pipelines, enhancing security analysis capabilities.
What it needs
Requires docker, git installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Horusec SAST Scanner Overview Horusec is an open-source security analysis tool that performs static code analysis across 18+ programming languages using 20+ integrated security tools. It identifies vulnerabilities during development, scans git history for exposed secrets, and integrates seamlessly into CI/CD pipelines for secure SDLC practices. Supported Languages C#, Java, Kotlin, Python, Ruby, Golang, Terraform, JavaScript, TypeScript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell, Nginx Quick Start Run Horusec scan on current project: Core Workflows Workflow 1: Local Security Scan For developers performing pre-commit security analysis: 1. Navigate to project directory 2. Run Horusec scan: 3. Review JSON output for vulnerabilities 4. Filter by severity (HIGH, MEDIUM, LOW, INFO) 5. Address critical and high-severity findings 6. Re-scan to validate fixes Workflow 2: CI/CD Pipeline Integration Progress: [ ] 1. Add Horusec to CI/CD pipeline configuration [ ] 2. Configure output format (JSON for automated processing) [ ] 3. Set severity threshold for build failures [ ] 4. Run scan on each commit or pull request [ ] 5. Parse results and fail build on high-severity findings [ ] 6. Generate security reports for audit trail [ ] 7. Track remediation progress over time Work through each step systematically. Check off completed items. Workflow 3: Git History Secret Scanning For detecting exposed credentials and secrets: 1. Run Horusec with git history analysis enabled: 2. Review detected secrets and credentials 3. Rotate compromised credentials immediately 4. Add detected patterns to .gitignore and .horusec/config.json 5. Use git-filter-branch or BFG Repo-Cleaner to remove from history (if needed) 6. Document incident and update security procedures Workflow 4: False Positive Management When managing scan results and reducing noise: 1. Run initial scan and export results: 2. Review findings and identify false positives 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/sast-horusec