Sast Scanning
This Sast Scanning skill automatically checks your codebase for known security vulnerabilities and outdated dependencies, boosting security posture.
Install on your platform
We auto-selected Claude Code based on this skill’s supported platforms.
Run in terminal (recommended)
claude mcp add sast-scanning npx -- -y @trustedskills/sast-scanning
Or manually add to ~/.claude/settings.json
{
"mcpServers": {
"sast-scanning": {
"command": "npx",
"args": [
"-y",
"@trustedskills/sast-scanning"
]
}
}
}Requires Claude Code (claude CLI). Run claude --version to verify your install.
About This Skill
What it does
This skill performs Static Application Security Testing (SAST) scanning on provided code repositories. It analyzes source code to identify potential security vulnerabilities, such as SQL injection flaws or cross-site scripting risks, without executing the code. The results are presented in a structured format for review and remediation.
When to use it
- New Project Setup: Integrate SAST scanning into your CI/CD pipeline when starting a new software project.
- Code Reviews: Use it to automatically scan code changes during pull requests or merge requests.
- Security Audits: Run periodic scans on existing codebases to identify newly discovered vulnerabilities.
- Compliance Requirements: Satisfy security compliance mandates that require regular static analysis of application source code.
Key capabilities
- Code Analysis: Analyzes provided code repositories for potential vulnerabilities.
- Vulnerability Identification: Identifies common security flaws like SQL injection and cross-site scripting.
- Structured Reporting: Presents scan results in a structured, machine-readable format.
Example prompts
- "Scan this GitHub repository for security vulnerabilities: [repository URL]"
- "Perform SAST analysis on the code located at [file path]."
- "Analyze this Python script and report any potential security issues."
Tips & gotchas
- The accuracy of SAST scanning depends heavily on the quality of the ruleset used. Ensure the skill utilizes a current and relevant ruleset for your technology stack.
Tags
TrustedSkills Verification
Unlike other registries that point to live repositories, TrustedSkills pins every skill to a verified commit hash. This protects you from malicious updates — what you install today is exactly what was reviewed and verified.
Security Audits
| Gen Agent Trust Hub | Pass |
| Socket | Pass |
| Snyk | Pass |
🌐 Community
Passed automated security scans.