New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Sast Configuration

by davila7 in davila7/claude-code-templates

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

MITAuto-check passedSecurity

Install Sast Configuration

skills CLI
$ npx skills add davila7/claude-code-templates --skill sast-configuration -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install davila7/claude-code-templates sast-configuration --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/davila7/claude-code-templates.git skills-src && mkdir -p .claude/skills && cp -r skills-src/cli-tool/components/skills/security/sast-configuration .claude/skills/sast-configuration && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
sast-configuration
GitHub stars
32k
Used in
11 other repos
Token cost
~1.6k tokens
SKILL.md length
591 words
Files
1
Skills in repo
478
Repo updated
First seen
Licence
MIT

At a glance

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

  • Works in 3 steps: Semgrep Configuration → SonarQube Setup → CodeQL Analysis
  • Tasks that involve Static analysis and SAST
  • SKILL.md covers Use this skill when, Do not use this skill when, Instructions and Safety, plus 12 more sections
  • Calls semgrep, pip and docker; reaches github.com

What it does

Sast Configuration is an agent skill from davila7/claude-code-templates. Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. It works with Semgrep. The repository describes itself as: CLI tool for configuring and monitoring Claude Code. The licence is MIT.

When your agent uses it

  • Tasks that involve Static analysis and SAST

Example prompts

  • “/sast-configuration”

Requirements

  • Python 3
  • Docker

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Semgrep Configuration
  2. SonarQube Setup
  3. CodeQL Analysis

What it can do on your machine

Read from SKILL.md and the folder at commit 46b4d8b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • semgrep
    • pip
    • docker
    • gh

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sast Configuration loads about 1.6k tokens when it runs. Until then it costs about 47 tokens; SKILL.md has 591 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~47
When it runs · the whole SKILL.md, loaded when a task matches
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from davila7/claude-code-templates at commit 46b4d8b, republished under its MIT licence (© davila7). 591 words, ~1,557 tokens.

Download SKILL.mdSave it as .claude/skills/sast-configuration/SKILL.md (or your agent's skills folder).
name
sast-configuration
description
Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.
risk
unknown
source
community
date_added
2026-02-27

SAST Configuration

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

Use this skill when

  • Set up SAST scanning in CI/CD pipelines
  • Create custom security rules for your codebase
  • Configure quality gates and compliance policies
  • Optimize scan performance and reduce false positives
  • Integrate multiple SAST tools for defense-in-depth

Do not use this skill when

  • You only need DAST or manual penetration testing guidance
  • You cannot access source code or CI/CD pipelines
  • You need organizational policy decisions rather than tooling setup

Instructions

  1. Identify languages, repos, and compliance requirements.
  2. Choose tools and define a baseline policy.
  3. Integrate scans into CI/CD with gating thresholds.
  4. Tune rules and suppressions based on false positives.
  5. Track remediation and verify fixes.

Safety

  • Avoid scanning sensitive repos with third-party services without approval.
  • Prevent leaks of secrets in scan artifacts and logs.

Overview

This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.

Core Capabilities

1. Semgrep Configuration
  • Custom rule creation with pattern matching
  • Language-specific security rules (Python, JavaScript, Go, Java, etc.)
  • CI/CD integration (GitHub Actions, GitLab CI, Jenkins)
  • False positive tuning and rule optimization
  • Organizational policy enforcement
2. SonarQube Setup
  • Quality gate configuration
  • Security hotspot analysis
  • Code coverage and technical debt tracking
  • Custom quality profiles for languages
  • Enterprise integration with LDAP/SAML
3. CodeQL Analysis
  • GitHub Advanced Security integration
  • Custom query development
  • Vulnerability variant analysis
  • Security research workflows
  • SARIF result processing

Quick Start

Initial Assessment
  1. Identify primary programming languages in your codebase
  2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)
  3. Choose SAST tool based on language support and integration needs
  4. Review baseline scan to understand current security posture
Basic Setup
bash
# Semgrep quick start
pip install semgrep
semgrep --config=auto --error

# SonarQube with Docker
docker run -d --name sonarqube -p 9000:9000 sonarqube:latest

# CodeQL CLI setup
gh extension install github/gh-codeql
codeql database create mydb --language=python

Reference Documentation

  • Semgrep Rule Creation - Pattern-based security rule development
  • SonarQube Configuration - Quality gates and profiles
  • CodeQL Setup Guide - Query development and workflows

Templates & Assets

  • semgrep-config.yml - Production-ready Semgrep configuration
  • sonarqube-settings.xml - SonarQube quality profile template
  • run-sast.sh - Automated SAST execution script

Integration Patterns

CI/CD Pipeline Integration
yaml
# GitHub Actions example
- name: Run Semgrep
  uses: returntocorp/semgrep-action@v1
  with:
    config: >-
      p/security-audit
      p/owasp-top-ten
Pre-commit Hook
bash
# .pre-commit-config.yaml
- repo: https://github.com/returntocorp/semgrep
  rev: v1.45.0
  hooks:
    - id: semgrep
      args: ['--config=auto', '--error']
Show full SKILL.md (259 more words)Show less

Best Practices

  1. Start with Baseline

    • Run initial scan to establish security baseline
    • Prioritize critical and high severity findings
    • Create remediation roadmap

  2. Incremental Adoption

    • Begin with security-focused rules
    • Gradually add code quality rules
    • Implement blocking only for critical issues

  3. False Positive Management

    • Document legitimate suppressions
    • Create allow lists for known safe patterns
    • Regularly review suppressed findings

  4. Performance Optimization

    • Exclude test files and generated code
    • Use incremental scanning for large codebases
    • Cache scan results in CI/CD

  5. Team Enablement

    • Provide security training for developers
    • Create internal documentation for common patterns
    • Establish security champions program

Common Use Cases

New Project Setup
bash
./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube
Custom Rule Development
yaml
# See references/semgrep-rules.md for detailed examples
rules:
  - id: hardcoded-jwt-secret
    pattern: jwt.encode($DATA, "...", ...)
    message: JWT secret should not be hardcoded
    severity: ERROR
Compliance Scanning
bash
# PCI-DSS focused scan
semgrep --config p/pci-dss --json -o pci-scan-results.json

Troubleshooting

High False Positive Rate
  • Review and tune rule sensitivity
  • Add path filters to exclude test files
  • Use nostmt metadata for noisy patterns
  • Create organization-specific rule exceptions
Performance Issues
  • Enable incremental scanning
  • Parallelize scans across modules
  • Optimize rule patterns for efficiency
  • Cache dependencies and scan results
Integration Failures
  • Verify API tokens and credentials
  • Check network connectivity and proxy settings
  • Review SARIF output format compatibility
  • Validate CI/CD runner permissions
  • OWASP Top 10 Checklist
  • Container Security
  • Dependency Scanning

Tool Comparison

ToolBest ForLanguage SupportCostIntegration
SemgrepCustom rules, fast scans30+ languagesFree/EnterpriseExcellent
SonarQubeCode quality + security25+ languagesFree/CommercialGood
CodeQLDeep analysis, research10+ languagesFree (OSS)GitHub native

Next Steps

  1. Complete initial SAST tool setup
  2. Run baseline security scan
  3. Create custom rules for organization-specific patterns
  4. Integrate into CI/CD pipeline
  5. Establish security gate policies
  6. Train development team on findings and remediation

© davila7, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in cli-tool/components/skills/security/sast-configuration of davila7/claude-code-templates.

Open the folder on GitHubat commit 46b4d8b

Used in 11 other repositories

We found 33 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 11 other GitHub owners. This page covers the copy in davila7/claude-code-templates, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Sast Configuration next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Sast Configuration compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Sast Configuration this skilldavila7/claude-code-templates32k11 repos~1.6kAutomated safety check: PassMIT
Semgrepvigolium/piolium1401 repos~2.4kAutomated safety check: NotesMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
Sast SemgrepAgentSecOps/SecOpsAgentKit2202 repos~2.4kAutomated safety check: PassCustom licence
Semgrep Rule Creatortrailofbits/skills7.4k6 repos~1.8kAutomated safety check: NotesCC-BY-SA-4.0
Semgrep Rule Variant Creatortrailofbits/skills7.4k5 repos~3.4kAutomated safety check: NotesCC-BY-SA-4.0

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    140 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated 2 days ago
    SecurityAuto-check: notes

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    220 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Semgrep Rule Creator

    trailofbits/skills

    Official

    Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns.

    7.4k GitHub starsUsed in 6 repos~1.8k tokens
    SecurityAuto-check: notes

  • Semgrep Rule Variant Creator

    trailofbits/skills

    Official

    Creates language variants of existing Semgrep rules. An agent skill from trailofbits/skills.

    7.4k GitHub starsUsed in 5 repos~3.4k tokens
    SecurityAuto-check: notes

  • Semgrep

    waybarrios/opencode-power-pack

    Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis.

    533 GitHub stars~2.4k tokensUpdated 4 days ago
    SecurityAuto-check passed

More from davila7/claude-code-templates

All 478 skills in this repo

  • Perplexity Web Search

    davila7/claude-code-templates

    Runs web-grounded searches through Perplexity's Sonar models over OpenRouter for current events, recent literature and cited facts beyond the model's training cutoff.

    32k GitHub starsUsed in 11 repos~3.5k tokens
    Auto-check: notes

  • Neuropixels Data Analysis

    davila7/claude-code-templates

    Analyzes Neuropixels recordings from SpikeGLX or Open Ephys through preprocessing, drift correction, Kilosort4 spike sorting, quality metrics and curation.

    32k GitHub starsUsed in 9 repos~2.8k tokens
    Auto-check passed

  • Scientific Venue Templates

    davila7/claude-code-templates

    Supplies LaTeX templates and formatting rules for journals, conferences, posters, and grant proposals, then can check a draft against them.

    32k GitHub starsUsed in 9 repos~5.1k tokens
    Auto-check: notes

  • Brand Voice Content Creator

    davila7/claude-code-templates

    Analyzes a brand's existing writing to lock in a consistent voice, then builds SEO blog posts and platform-specific social content around it.

    32k GitHub starsUsed in 3 repos~1.9k tokens
    Auto-check passed

  • CAPA Officer

    davila7/claude-code-templates

    Guides corrective and preventive action (CAPA) work in a quality management system, from initiation and root cause analysis through effectiveness verification.

    32k GitHub starsUsed in 1 repo~2k tokens
    Auto-check passed

  • Fda Consultant Specialist

    davila7/claude-code-templates

    Senior FDA consultant and specialist for medical device companies including HIPAA compliance and requirement management.

    32k GitHub starsUsed in 1 repo~2.7k tokens
    Auto-check passed

Works with

Categories

Questions about Sast Configuration

What does Sast Configuration do?

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages. Sast Configuration is an agent skill from davila7/claude-code-templates. Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

When should I use Sast Configuration?

Sast Configuration fits situations like: tasks that involve Static analysis and SAST.

How do I install Sast Configuration in Claude Code?

Run `npx skills add davila7/claude-code-templates --skill sast-configuration -a claude-code`. Or copy the skill folder (cli-tool/components/skills/security/sast-configuration in davila7/claude-code-templates) into .claude/skills/sast-configuration in your project. Claude Code loads it when a task matches its description.

How do I install Sast Configuration in Codex?

Run `npx skills add davila7/claude-code-templates --skill sast-configuration -a codex`. Or copy the skill folder (cli-tool/components/skills/security/sast-configuration in davila7/claude-code-templates) into .agents/skills/sast-configuration in your project. Codex loads it when a task matches its description.

Can I use Sast Configuration in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add davila7/claude-code-templates --skill sast-configuration -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sast-configuration, .gemini/skills/sast-configuration, .github/skills/sast-configuration and .opencode/skills/sast-configuration in your project.

What does Sast Configuration need to run?

Going by SKILL.md and its folder, Sast Configuration needs the command-line tools its instructions call (semgrep, pip, docker and gh). Our summary lists: Python 3; Docker.

Does Sast Configuration access the network?

SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Sast Configuration safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Sast Configuration use?

Sast Configuration is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Sast Configuration use?

About 1.6k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Sast Configuration?

Skills that share tags, products or a category with Sast Configuration: Semgrep (vigolium/piolium, 140 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars), Sast Semgrep (AgentSecOps/SecOpsAgentKit, 220 stars) and Semgrep Rule Creator (trailofbits/skills, 7.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Sast Configuration?

davila7 (a GitHub user) maintains it in davila7/claude-code-templates, which has 32,483 GitHub stars. The repository holds 478 skills in this directory. The repository was last updated on October 9, 2026.

Source: davila7/claude-code-templates on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.