Security Scanning Security Sast
Automates SAST scans, identifying vulnerabilities in codebases with detailed reports and remediation guidance.
Install on your platform
We auto-selected Claude Code based on this skill’s supported platforms.
Run in terminal (recommended)
claude mcp add security-scanning-security-sast npx -- -y @trustedskills/security-scanning-security-sast
Or manually add to ~/.claude/settings.json
{
"mcpServers": {
"security-scanning-security-sast": {
"command": "npx",
"args": [
"-y",
"@trustedskills/security-scanning-security-sast"
]
}
}
}Requires Claude Code (claude CLI). Run claude --version to verify your install.
About This Skill
What it does
This skill enables AI agents to perform Static Application Security Testing (SAST) by analyzing source code without executing the application. It identifies potential vulnerabilities and security flaws directly within the codebase to ensure robust software development practices.
When to use it
- Reviewing new code contributions before merging into a main branch.
- Conducting pre-deployment checks on critical infrastructure scripts.
- Auditing third-party libraries for known security weaknesses.
- Integrating automated security gates into continuous integration pipelines.
Key capabilities
- Analyzes source code for static security vulnerabilities.
- Operates without requiring the application to be running.
- Provides actionable reports on potential security flaws.
- Supports various programming languages commonly used in development.
Example prompts
- "Run a SAST scan on my Python project to identify any injection vulnerabilities."
- "Analyze this JavaScript module for common security anti-patterns and report findings."
- "Perform a static security check on the recent commit before it gets merged."
Tips & gotchas
Ensure your codebase is clean of build artifacts before scanning to avoid false positives from compiled binaries. Remember that SAST tools may miss runtime-specific issues, so complement this with dynamic testing for comprehensive coverage.
Tags
TrustedSkills Verification
Unlike other registries that point to live repositories, TrustedSkills pins every skill to a verified commit hash. This protects you from malicious updates — what you install today is exactly what was reviewed and verified.
Security Audits
| Gen Agent Trust Hub | Pass |
| Socket | Pass |
| Snyk | Pass |
🌐 Community
Passed automated security scans.