New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Static Analysis Sweep

by OneWave-AI in OneWave-AI/claude-skills

A skill your agent uses to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now…

MITAuto-check passedSecurity

Install Static Analysis Sweep

skills CLI
$ npx skills add OneWave-AI/claude-skills --skill static-analysis-sweep -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install OneWave-AI/claude-skills static-analysis-sweep --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/OneWave-AI/claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/static-analysis-sweep .claude/skills/static-analysis-sweep && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
static-analysis-sweep
GitHub stars
328
Token cost
~836 tokens
SKILL.md length
339 words
Files
1
Skills in repo
69
Repo updated
First seen
Licence
MIT

At a glance

A skill your agent uses to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now…

  • Run real static analysis over a diff
  • SKILL.md covers Core Behavior, The Tools, Triage and Secrets, plus 1 more section
  • Calls semgrep, gitleaks and git
  • Repo before shipping — Semgrep

What it does

Static Analysis Sweep is an agent skill from OneWave-AI/claude-skills. Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise. Trigger before a release or PR merge, during a security review, or when the user asks to scan the code for vulnerabilities.

Its SKILL.md is about 840 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. It works with Semgrep. The repository describes itself as: 200+ production-ready Claude Code skills for sales, marketing, design, engineering, and AI agent architecture. Built and maintained by OneWave AI. The licence is MIT.

When your agent uses it

  • Run real static analysis over a diff
  • Repo before shipping — Semgrep
  • Secret scanning
  • Dependency CVEs — and triage the findings into what must be fixed now versus noise

Example prompts

  • “/static-analysis-sweep”

What it can do on your machine

Read from SKILL.md and the folder at commit fc5b785. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • semgrep
    • gitleaks
    • git
    • npm

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git and npm, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Static Analysis Sweep loads about 836 tokens when it runs. Until then it costs about 83 tokens; SKILL.md has 339 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~83
When it runs · the whole SKILL.md, loaded when a task matches
~836

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from OneWave-AI/claude-skills at commit fc5b785, republished under its MIT licence (© OneWave-AI). 339 words, ~836 tokens.

Download SKILL.mdSave it as .claude/skills/static-analysis-sweep/SKILL.md (or your agent's skills folder).
name
static-analysis-sweep
description
Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise. Trigger before a release or PR merge, during a security review, or when the user asks to scan the code for vulnerabilities.
tools
Read, Write, Edit, Bash, Glob, Grep

Static Analysis Sweep

Reading code for bugs finds what you thought to look for. A scanner finds the rest. This skill runs the tools, then does the part the tools cannot: deciding which findings are real.

Core Behavior

Scan the diff first, the repo second. Triage every finding. Never hand over a raw scanner dump — an unfiltered report is how real findings get ignored.

The Tools

Semgrep — fast, pattern-based, good defaults, no build required.

bash
semgrep --config=auto --error --quiet .                    # whole repo
semgrep --config=auto --quiet --baseline-commit=origin/main # diff only

Secret scanning — the highest-value scan per second spent.

bash
gitleaks detect --no-banner --redact
git log -p -S'BEGIN PRIVATE KEY' --oneline | head

Dependency CVEs

bash
npm audit --audit-level=high 2>&1 | tail -40
pip-audit 2>&1 | tail -40

CodeQL — deeper, needs a build, worth it on a release branch rather than every PR.

bash
codeql database create db --language=javascript --overwrite
codeql database analyze db --format=sarif-latest --output=results.sarif

If a tool is not installed, say so and run what is available rather than silently skipping the whole sweep.

Triage

Every finding lands in one of four buckets:

Fix now — reachable from untrusted input and causes real damage: injection into a query or shell, authentication or authorization bypass, secrets in the repo, deserialization of user data, path traversal, SSRF against internal hosts.

Fix soon — real weakness, limited blast radius: missing rate limit, weak crypto choice, permissive CORS on a non-sensitive route, a dependency CVE with no exploit path.

Won't fix, explained — the pattern matched, the exploit does not exist here. Write the one-line reason. This is the bucket that earns trust in the report.

Noise — test fixtures, generated files, vendored code. Suppress with a targeted ignore, never by turning the rule off globally.

For each Fix-now item, prove reachability before claiming it: name the entry point, the path the data takes, and the sink. A finding you cannot trace is Fix-soon at best.

Secrets

If a live credential is found in the working tree or in history, stop and tell the user immediately. Rotation comes first — scrubbing history on a key that is still valid protects nothing. Never print the secret back in full.

Report Format

markdown
## Scan — <scope> — <date>
Tools: <which ran, which were unavailable>

### Fix now (n)
1. **<issue>** — `file:line`
   Path: <entry point> → <sink>
   Fix: <the concrete change>

### Fix soon (n)
- <issue> — `file:line` — <why it is limited>

### Reviewed, not an issue (n)
- <finding> — <why it does not apply here>

Ranked by severity, not by file order. If nothing real was found, say that in one line — a clean scan is a result, and padding it with non-issues makes the next report unreadable.

© OneWave-AI, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in static-analysis-sweep of OneWave-AI/claude-skills.

Open the folder on GitHubat commit fc5b785

Compare with similar skills

Static Analysis Sweep next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Static Analysis Sweep compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Static Analysis Sweep this skillOneWave-AI/claude-skills328—~836Automated safety check: PassMIT
Semgrepvigolium/piolium1401 repos~2.4kAutomated safety check: NotesMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
Sast SemgrepAgentSecOps/SecOpsAgentKit2202 repos~2.4kAutomated safety check: PassCustom licence
Semgrep Rule Creatortrailofbits/skills7.4k6 repos~1.8kAutomated safety check: NotesCC-BY-SA-4.0
Semgrep Rule Variant Creatortrailofbits/skills7.4k5 repos~3.4kAutomated safety check: NotesCC-BY-SA-4.0

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    140 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    220 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Semgrep Rule Creator

    trailofbits/skills

    Official

    Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns.

    7.4k GitHub starsUsed in 6 repos~1.8k tokens
    SecurityAuto-check: notes

  • Semgrep Rule Variant Creator

    trailofbits/skills

    Official

    Creates language variants of existing Semgrep rules. An agent skill from trailofbits/skills.

    7.4k GitHub starsUsed in 5 repos~3.4k tokens
    SecurityAuto-check: notes

  • Semgrep

    waybarrios/opencode-power-pack

    Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis.

    533 GitHub stars~2.4k tokensUpdated 3 days ago
    SecurityAuto-check passed

More from OneWave-AI/claude-skills

All 69 skills in this repo

  • CRM Data Cleanup

    OneWave-AI/claude-skills

    Finds duplicate and junk records in a CRM CSV export with fuzzy matching, normalizes fields and writes a reviewable merge plan plus import-ready files without touching the live CRM.

    328 GitHub stars~2.5k tokensUpdated 7 days ago
    Auto-check passed

  • Design Export Repair

    OneWave-AI/claude-skills

    Repairs broken decks and PDFs exported from Claude Design or similar AI deck generators: clipped text, wrong fonts and corrupted .pptx package structure.

    328 GitHub stars~2.6k tokensUpdated 7 days ago
    Auto-check passed

  • Bi Measure Builder

    OneWave-AI/claude-skills

    Writes, explains, debugs, and optimizes BI calculations - Power BI / Fabric DAX measures and calculated columns, Tableau calculated fields (FIXED/INCLUDE/EXCLUDE LOD expressions, table…

    328 GitHub stars~2.2k tokensUpdated 7 days ago
    Auto-check passed

  • Bookkeeping Close

    OneWave-AI/claude-skills

    Categorizes transactions, reconciles bank and card statements to the ledger, works a month-end checklist and prepares a close package, without ever forcing a balance.

    328 GitHub stars~2k tokensUpdated 7 days ago
    Auto-check passed

  • CSV and Excel Merger

    OneWave-AI/claude-skills

    Combines CSV, TSV and Excel files into one verified table with pandas, by stacking or joining, mapping columns, normalizing keys and removing duplicates.

    328 GitHub stars~1.6k tokensUpdated 7 days ago
    Auto-check passed

  • Sec Filing Puller

    OneWave-AI/claude-skills

    Pulls financial statement numbers for US public companies straight from SEC EDGAR's free official XBRL APIs (companyfacts, companyconcept, frames, submissions) into a cited table.

    328 GitHub stars~2.1k tokensUpdated 7 days ago
    Auto-check passed

Works with

Categories

Questions about Static Analysis Sweep

What does Static Analysis Sweep do?

A skill your agent uses to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now…. Static Analysis Sweep is an agent skill from OneWave-AI/claude-skills. Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise.

When should I use Static Analysis Sweep?

Static Analysis Sweep fits situations like: run real static analysis over a diff; repo before shipping — Semgrep; secret scanning; dependency CVEs — and triage the findings into what must be fixed now versus noise.

How do I install Static Analysis Sweep in Claude Code?

Run `npx skills add OneWave-AI/claude-skills --skill static-analysis-sweep -a claude-code`. Or copy the skill folder (static-analysis-sweep in OneWave-AI/claude-skills) into .claude/skills/static-analysis-sweep in your project. Claude Code loads it when a task matches its description.

How do I install Static Analysis Sweep in Codex?

Run `npx skills add OneWave-AI/claude-skills --skill static-analysis-sweep -a codex`. Or copy the skill folder (static-analysis-sweep in OneWave-AI/claude-skills) into .agents/skills/static-analysis-sweep in your project. Codex loads it when a task matches its description.

Can I use Static Analysis Sweep in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add OneWave-AI/claude-skills --skill static-analysis-sweep -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/static-analysis-sweep, .gemini/skills/static-analysis-sweep, .github/skills/static-analysis-sweep and .opencode/skills/static-analysis-sweep in your project.

What does Static Analysis Sweep need to run?

Going by SKILL.md and its folder, Static Analysis Sweep needs the command-line tools its instructions call (semgrep, gitleaks, git and npm).

Does Static Analysis Sweep access the network?

SKILL.md contains no URLs. Its commands use git and npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Static Analysis Sweep safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Static Analysis Sweep use?

Static Analysis Sweep is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Static Analysis Sweep use?

About 836 tokens (SKILL.md is roughly 3.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Static Analysis Sweep?

Skills that share tags, products or a category with Static Analysis Sweep: Semgrep (vigolium/piolium, 140 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars), Sast Semgrep (AgentSecOps/SecOpsAgentKit, 220 stars) and Semgrep Rule Creator (trailofbits/skills, 7.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Static Analysis Sweep?

OneWave-AI (a GitHub organization) maintains it in OneWave-AI/claude-skills, which has 328 GitHub stars. The repository holds 69 skills in this directory. The repository was last updated on October 2, 2026.

Source: OneWave-AI/claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.