New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Static Analysis

by pilinux in pilinux/gorest

Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps.

MITAuto-check passedSecurity

Install Static Analysis

skills CLI
$ npx skills add pilinux/gorest --skill static-analysis -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install pilinux/gorest static-analysis --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/pilinux/gorest.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/static-analysis .claude/skills/static-analysis && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
static-analysis
GitHub stars
506
Token cost
~266 tokens
SKILL.md length
98 words
Files
1
Skills in repo
20
Repo updated
First seen
Licence
MIT

At a glance

Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps.

  • Tasks that involve Static analysis and SAST
  • SKILL.md covers When to Use, Rules, Commands and Cross-Platform Vet, plus 2 more sections
  • Calls go

What it does

Static Analysis is an agent skill from pilinux/gorest. Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps.

Its SKILL.md is about 270 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. The repository describes itself as: Go RESTful API starter kit with Gin, JWT, GORM (MySQL, PostgreSQL, SQLite), Redis, Mongo, 2FA, email verification, password recovery. The licence is MIT.

When your agent uses it

  • Tasks that involve Static analysis and SAST

Example prompts

  • “/static-analysis”

What it can do on your machine

Read from SKILL.md and the folder at commit 38aab64. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • go

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Static Analysis loads about 266 tokens when it runs. Until then it costs about 32 tokens; SKILL.md has 98 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~32
When it runs · the whole SKILL.md, loaded when a task matches
~266

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from pilinux/gorest at commit 38aab64, republished under its MIT licence (© pilinux). 98 words, ~266 tokens.

Download SKILL.mdSave it as .claude/skills/static-analysis/SKILL.md (or your agent's skills folder).
name
static-analysis
description
Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps.
license
MIT
metadata.mode
verify
metadata.purpose
static-analysis

Static Analysis

When to Use

  • Security or correctness checks are requested, or to reproduce CI static-analysis failures locally.

Rules

  • Use repository-standard tooling where configured.
  • Summarize findings by severity and provide minimal remediation steps.
  • Avoid suppressing issues unless instructed.

Commands

  • go vet -v ./...
  • gosec ./...
  • govulncheck ./...

Cross-Platform Vet

CI runs vet on six OS/arch combos. Key examples:

  • GOOS=linux GOARCH=amd64 go vet -v ./...
  • GOOS=darwin GOARCH=arm64 go vet -v ./...
  • GOOS=windows GOARCH=amd64 go vet -v ./...

Output

  • Findings grouped by tool and severity.
  • For each: path:line, plain-language meaning, and a minimal fix suggestion.
  • Verification: commands to re-run the specific tool.
  • linter-runner, ci-orchestrator

© pilinux, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/static-analysis of pilinux/gorest.

Open the folder on GitHubat commit 38aab64

Compare with similar skills

Static Analysis next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Static Analysis compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Static Analysis this skillpilinux/gorest506—~266Automated safety check: PassMIT
Semgrepvigolium/piolium1401 repos~2.4kAutomated safety check: NotesMIT
C To AstNarwhal-Lab/MagicSkills316—~1.1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
LLM Sast ScannerSunWeb3Sec/llm-sast-scanner286—~6.2kAutomated safety check: PassNone
Sast SemgrepAgentSecOps/SecOpsAgentKit2202 repos~2.4kAutomated safety check: PassCustom licence

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    140 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • C To Ast

    Narwhal-Lab/MagicSkills

    Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.

    316 GitHub stars~1.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated yesterday
    SecurityAuto-check: notes

  • LLM Sast Scanner

    SunWeb3Sec/llm-sast-scanner

    General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.

    286 GitHub stars~6.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    220 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Triage Codeql

    netdata/netdata

    Inspect, review or triage GitHub Code Scanning alerts, including CodeQL findings; apply verified dismissals when authorized.

    81k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes

More from pilinux/gorest

All 20 skills in this repo

  • Config Loader Helper

    pilinux/gorest

    Diagnoses configuration failures in the gorest project by listing the required environment variables grouped by feature and giving minimal commands for a safe local test setup.

    506 GitHub stars~441 tokensUpdated 12 days ago
    Auto-check passed

  • Go AST Code Introspection

    pilinux/gorest

    Enumerates Go declarations and signatures from the syntax tree, then proposes small, mechanically safe refactors with file and line citations.

    506 GitHub stars~414 tokensUpdated 12 days ago
    Auto-check passed

  • Local Build and Run

    pilinux/gorest

    Builds and runs a Go project locally to reproduce compile or runtime problems safely, using test environment variables and mocks instead of production credentials.

    506 GitHub stars~362 tokensUpdated 12 days ago
    Auto-check passed

  • Code Navigation

    pilinux/gorest

    Rapid, focused navigation to locate definitions/usages and map the impact of proposed changes.

    506 GitHub stars~354 tokensUpdated 12 days ago
    Auto-check passed

  • Cited Code Explainer

    pilinux/gorest

    Explains how a module behaves in a few short, read-only sections, with a path-and-line citation behind every non-trivial claim.

    506 GitHub stars~244 tokensUpdated 12 days ago
    Auto-check passed

  • Cited File Reader

    pilinux/gorest

    Reads only the lines needed from a source file and answers with a short summary and path:line citations, without changing anything.

    506 GitHub stars~250 tokensUpdated 12 days ago
    Auto-check passed

Categories

Questions about Static Analysis

What does Static Analysis do?

Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps. Static Analysis is an agent skill from pilinux/gorest. Run CI-aligned static analysis (vet, gosec, govulncheck) and convert findings into prioritized remediation steps.

When should I use Static Analysis?

Static Analysis fits situations like: tasks that involve Static analysis and SAST.

How do I install Static Analysis in Claude Code?

Run `npx skills add pilinux/gorest --skill static-analysis -a claude-code`. Or copy the skill folder (.agents/skills/static-analysis in pilinux/gorest) into .claude/skills/static-analysis in your project. Claude Code loads it when a task matches its description.

How do I install Static Analysis in Codex?

Run `npx skills add pilinux/gorest --skill static-analysis -a codex`. Or copy the skill folder (.agents/skills/static-analysis in pilinux/gorest) into .agents/skills/static-analysis in your project. Codex loads it when a task matches its description.

Can I use Static Analysis in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add pilinux/gorest --skill static-analysis -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/static-analysis, .gemini/skills/static-analysis, .github/skills/static-analysis and .opencode/skills/static-analysis in your project.

What does Static Analysis need to run?

Going by SKILL.md and its folder, Static Analysis needs the command-line tools its instructions call (go).

Does Static Analysis access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Static Analysis safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Static Analysis use?

Static Analysis is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Static Analysis use?

About 266 tokens (SKILL.md is roughly 1.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Static Analysis?

Skills that share tags, products or a category with Static Analysis: Semgrep (vigolium/piolium, 140 stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Semgrep Security Scan (trailofbits/skills, 7.4k stars) and LLM Sast Scanner (SunWeb3Sec/llm-sast-scanner, 286 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Static Analysis?

pilinux (a GitHub user) maintains it in pilinux/gorest, which has 506 GitHub stars. The repository holds 20 skills in this directory. The repository was last updated on September 25, 2026.

Source: pilinux/gorest on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.