sast-skills

Turn your LLM coding assistant into a fully featured SAST scanner.

Drop-in agent skills for14 AI assistants— Claude Code, OpenAI Codex CLI, Gemini CLI, GitHub Copilot, Cursor, Windsurf, OpenCode, Cline, Antigravity, Aider, Kilo Code, Augment Code, Hermes Agent, and Mistral Vibe.

Claude Code with Opus is recommended for quality; any capable model works.

npx sast-skills install # pick your assistant(s) — ones found on your PATH are pre-enabled

Then open the project in your assistant and prompt:

It runs all four phases and writes findings tosast/. Aggregate them withnpx sast-skills export --format sariffor GitHub Code Scanning or CI.

- ✨ Highlights
- 🔄 Flow
- 🔍 What it detects
- 📦 Installation
- 🚀 Running a scan
- 🔌 CI integrations
- 🩺 Verify & troubleshoot
- 🤝 Contributing
- 📄 License

flowchart TD U(["User: Run vulnerability scan"]) --> R{"CLAUDE.md / AGENTS.md orchestrator"} R --> S1["Step 1 — sast-analysis<br/>codebase and architecture map"] S1 -->|sast/architecture.md| S2["Step 2 — parallel vulnerability scan<br/>64 skills: recon, batched verify, merge"] S2 -->|sast/-results.md and -results.json| S3["Step 3 — sast-report<br/>consolidate and rank"] S3 -->|sast/final-report.md| S4["Step 4 — sast-triage<br/>false-positive elimination,<br/>severity adjustment with evidence"] S4 -->|sast/final-report-triaged.md and triaged.json| EXP["npx sast-skills export<br/>JSON, SARIF, HTML"] EXP --> CS(["GitHub Code Scanning, CI, dashboards"])

Every step isidempotent: if its output file already exists, the orchestrator skips it. Re-run the scan after fixing issues to refresh only what's stale.

All skills follow the same three-phase pattern:recon→batched verify(parallel subagents, 3 per batch) →merge. Each writes a human-readable markdown report and a canonical JSON findings file thatsast-skills exportaggregates.

The 2026-era attack surface most signature scanners miss — natural-language manipulation, MCP tool poisoning, config-as-execution, and over-privileged agent identities. These skills use an LLM-driven verify step, not regex matching.

Runtime behaviour of LLM and agent applications — tool authority, retrieval isolation, prompt-secret hygiene, memory trust, and cost bounds. The tech-stack router gates these so they never run on codebases with no LLM/agent dependencies.

The installer shows a multi-select of all 14 supported assistants (plusAll of the above) and asks whether to install into the current project or your user home directory (project/global). To skip prompts, pass a comma-separated list of assistant ids (orall):

npx sast-skills install --yes --assistant claude,cursor,copilot --scope project

If your project already contains aCLAUDE.mdorAGENTS.md, the installer refuses to clobber it by default — back it up or pass--force.

Use this path if you can't runnpx(corporate proxy, npm registry unreachable, offline environment) or if you want to pin to this fork's source rather than the published npm package. The CLI installer only does two things — drop the orchestrator entry file at the project root and mirror each skill'sSKILL.mdinto the right hidden directory — so a plaincp -Rreproduces it exactly.

git clone https://github.com/mstfknn/sast-skills.git

Everything you need lives undersast-skills/sast-files/:

sast-files/ ├── CLAUDE.md # Orchestrator entry for Claude Code ├── AGENTS.md # Orchestrator entry for Gemini CLI / Codex / OpenCode / Cursor ├── .claude/skills/sast-/SKILL.md # 68 skills in Claude Code format └── .agents/skills/sast-/SKILL.md # Same 68 skills mirrored for AGENTS.md assistants

The two skill trees are kept in sync bynpm run sync— content is identical, only the directory name differs.

SetSAST_SRCto the clone path so the commands below stay copy-pasteable:

export SAST_SRC=/absolute/path/to/sast-skills cd /path/to/your-project

Project scope(recommended — versioned alongside your repo):

cp "$SAST_SRC/sast-files/CLAUDE.md" ./CLAUDE.md cp -R "$SAST_SRC/sast-files/.claude" ./

If you already use a project-levelCLAUDE.md,do not overwrite it— Claude Code reads only oneCLAUDE.mdper project. Merge the orchestrator content (the four-phase flow) into your existing file instead.

Global scope(skills available in every project; orchestrator still copied per-project):

mkdir -p ~/.claude/skills cp -R "$SAST_SRC/sast-files/.claude/skills/." ~/.claude/skills/ # Then in any project where you want the scan flow: cp "$SAST_SRC/sast-files/CLAUDE.md" /path/to/your-project/CLAUDE.md

2b. Install for Gemini CLI (and otherAGENTS.mdassistants)

export SAST_SRC=/absolute/path/to/sast-skills cd /path/to/your-project cp "$SAST_SRC/sast-files/AGENTS.md" ./AGENTS.md cp -R "$SAST_SRC/sast-files/.agents" ./

Gemini CLI readsGEMINI.md; the installer writes it for you when you pick Gemini.

# Project scope (Claude Code) ls CLAUDE.md && ls .claude/skills/ | head # Project scope (Gemini / AGENTS.md) ls AGENTS.md && ls .agents/skills/ | head # Global scope (Claude Code) ls ~/.claude/skills/ | head

You should see all 31sast-*skill directories. Open the project in your assistant and prompt"Run vulnerability scan"— the orchestrator insideCLAUDE.md/AGENTS.mddrives the four phases from there.

cd "$SAST_SRC" && git pull # Re-run the cp commands from Step 2a / 2b to refresh — they're idempotent.

If you keep the clone around,cd "$SAST_SRC" && git pull && <rerun cp>is the manual equivalent ofnpx sast-skills update.

After installing, open the project in your AI assistant and ask:

The orchestrator takes over. It runs all four phases automatically, respects idempotency (re-runs only pick up what's missing), and writes everything intosast/in your project root.

Each skill writessast/<skill>-results.jsonas a bare findings list:

{ "findings": [ { "id": "sast-sqli-0001", "skill": "sast-sqli", "severity": "critical|high|medium|low|info", "title": "SQL injection in /api/user", "description": "…", "location": { "file": "src/api/user.js", "line": 42, "column": 10 }, "remediation": "…" } ] }

sast-skills exportaggregates those files into one document wrapped in arunenvelope —{ "run": { "tool": "sast-skills", "version": "<cli-version>" }, "findings": [...] }— stamping the version of the CLI that produced the report. The triage step writessast/triaged.jsonin that same enveloped shape.

Triaged findings addtriage_status(confirmed|upgraded|downgraded|false_positive),triage_original_severity(when severity changed), andtriage_evidencewith concrete codebase citations.

Composite action at.github/actions/scan/action.yml:

- uses: mstfknn/sast-skills/.github/actions/scan@main with: input: sast/ output: sast-skills.sarif

This runssast-skills export --format sarifand uploads the result to Code Scanning viagithub/codeql-action/upload-sarif@v3.

Copyhooks/pre-commitinto.git/hooks/pre-committo makesast-skills doctorgate every commit.

docker build -t sast-skills . docker run --rm -v "$PWD:/work" sast-skills export --input sast/ --format sarif --output report.sarif

# Is the install in the expected shape? npx sast-skills doctor --target . --assistant claude # Version check npx sast-skills --version npm view sast-skills version # latest on the registry # Upgrade npx sast-skills update

npm install npm test # vitest suite (TDD-guard enabled; count shown in the tests badge) npm run sync # mirror .claude/skills → .agents/skills node scripts/scaffold-skill.js sast-foo # stub a new skill in both trees node scripts/register-skill.js sast-foo foo "Foo" "Foo injection description" npm run lint:md # markdownlint

- Community standards:CODE_OF_CONDUCT.md
- Release history:CHANGELOG.md

An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.