New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Sast Analysis

by utkusen in utkusen/sast-skills

Perform codebase analysis and architecture mapping as the first phase of a security assessment.

MITAuto-check passedSecurity

Install Sast Analysis

skills CLI
$ npx skills add utkusen/sast-skills --skill sast-analysis -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install utkusen/sast-skills sast-analysis --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/utkusen/sast-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/sast-files/.agents/skills/sast-analysis .claude/skills/sast-analysis && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
sast-analysis
GitHub stars
1.3k
Token cost
~1k tokens
SKILL.md length
364 words
Files
1
Skills in repo
16
Repo updated
First seen
Licence
MIT

At a glance

Perform codebase analysis and architecture mapping as the first phase of a security assessment.

  • Works in 2 steps: Technology Reconnaissance → Architecture Mapping
  • Asked to analyze a codebase for security
  • SKILL.md covers Phase 1: Technology…, Phase 2: Architecture Mapping and Important Reminders
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Sast Analysis is an agent skill from utkusen/sast-skills. Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist.

Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST, Codebase onboarding and Security review. The repository describes itself as: Collection of agent skills to find vulnerabilities inside your web/mobile apps. The licence is MIT.

When your agent uses it

  • Asked to analyze a codebase for security
  • Sast/architecture.md does not yet exist

Example prompts

  • “/sast-analysis”

Requirements

  • Docker

Workflow steps

2 steps, taken from the step headings in SKILL.md.

  1. Technology Reconnaissance
  2. Architecture Mapping

What it can do on your machine

Read from SKILL.md and the folder at commit db52227. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sast Analysis loads about 1k tokens when it runs. Until then it costs about 94 tokens; SKILL.md has 364 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~94
When it runs · the whole SKILL.md, loaded when a task matches
~1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from utkusen/sast-skills at commit db52227, republished under its MIT licence (© utkusen). 364 words, ~1,013 tokens.

Download SKILL.mdSave it as .claude/skills/sast-analysis/SKILL.md (or your agent's skills folder).
name
sast-analysis
description
Perform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist.

Codebase Analysis

You are performing the first phase of a security assessment. Your goal is to deeply understand the codebase. You are NOT looking for specific vulnerabilities yet. This is pure reconnaissance.

Create a sast/ folder in the project root (if it doesn't already exist). This phase produces one output file inside it:

sast/architecture.md — technology stack, architecture, entry points, data flows

Phase 1: Technology Reconnaissance

Explore the codebase and identify:

  • Languages: All programming languages used and their versions if specified
  • Frameworks: Web frameworks, ORM layers, template engines, task queues
  • Package managers & dependencies: Lock files, dependency manifests (package.json, requirements.txt, go.mod, Gemfile, pom.xml, etc.)
  • Infrastructure hints: Dockerfiles, docker-compose, Kubernetes manifests, Terraform, CI/CD configs
  • Databases: SQL, NoSQL, cache layers, message brokers — look at connection strings, ORM models, migration files
  • Authentication & authorization: Auth libraries, middleware, session configs, OAuth/OIDC providers, JWT usage, API key patterns
  • External integrations: Third-party APIs, payment processors, email services, cloud SDKs, webhook handlers
  • Entry points: HTTP routes, GraphQL schemas, gRPC service definitions, CLI commands, WebSocket handlers, scheduled jobs, message consumers

Start by reading dependency manifests, project configs, and directory structure. Then drill into source code to confirm findings.

Show full SKILL.md (177 more words)Show less

Phase 2: Architecture Mapping

Based on Phase 1, build a mental model of:

  1. Service boundaries: Is this a monolith or microservices? What talks to what?
  2. Data flow: How does user input enter the system, get processed, get stored, and get returned?
  3. Trust boundaries: Where does the system transition between trusted and untrusted contexts? (e.g., user input -> backend, backend -> database, service -> service, server -> client)
  4. Privilege levels: What roles/permissions exist? How are they enforced? Is there an admin panel?
  5. Sensitive data inventory: PII, credentials, tokens, financial data, health records — where is each stored and how does it move?

Write the results of Phase 1 and Phase 2 to sast/architecture.md. Use this format:

markdown
# Architecture: [Project Name]

## Technology Stack

| Category | Details |
|---|---|
| Languages | ... |
| Frameworks | ... |
| Databases | ... |
| Auth mechanism | ... |
| Infrastructure | ... |
| External services | ... |

## Architecture Overview

[Describe the architecture: monolith vs microservices, how components interact,
main modules and their responsibilities]

## Data Flow

[Trace how user input enters the system, gets processed, stored, and returned.
Cover the primary flows (e.g., registration, login, core business actions).]

## Entry Points

| Entry Point | Type | Auth Required | Description |
|---|---|---|---|
| ... | HTTP/GraphQL/WS/etc. | Yes/No | ... |

## Trust Boundaries

[List each trust boundary and what crosses it]

## Sensitive Data Inventory

| Data Type | Where Stored | How Accessed | Protection |
|---|---|---|---|
| ... | ... | ... | ... |

Important Reminders

  • Do NOT report specific vulnerabilities (like "line 42 has SQL injection"). That comes in later phases.
  • Be thorough in exploration. Read actual source code, not just config files. Look at how auth middleware is applied, how queries are built, how file uploads are handled.
  • If the codebase is large, prioritize security-sensitive areas: auth, payment, data access, file handling, admin functionality.

© utkusen, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in sast-files/.agents/skills/sast-analysis of utkusen/sast-skills.

Open the folder on GitHubat commit db52227

Compare with similar skills

Sast Analysis next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Sast Analysis compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Sast Analysis this skillutkusen/sast-skills1.3k—~1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.4k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
CodeCrucible Security Scansblock/codecrucible117—~1.2kAutomated safety check: PassApache-2.0
Auditvigolium/piolium140—~8.7kAutomated safety check: PassMIT
Codeqlwaybarrios/opencode-power-pack5332 repos~3.7kAutomated safety check: PassMIT
Agentic GitHub Actions Auditortrailofbits/skills7.4k6 repos~5.4kAutomated safety check: NotesCC-BY-SA-4.0

Similar skills

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.4k GitHub stars~3.7k tokensUpdated yesterday
    SecurityAuto-check: notes

  • CodeCrucible Security Scans

    block/codecrucible

    Official

    Runs the codecrucible CLI for LLM-backed security scans of a repository, checks scope and cost first with a dry run, and reads the SARIF results.

    117 GitHub stars~1.2k tokensUpdated 2 days ago
    SecurityAuto-check passed

  • Audit

    vigolium/piolium

    A skill your agent uses when running a full security audit of an arbitrary source code repository, especially large, complex, multi-component, distributed, or non-standard architectures.

    140 GitHub stars~8.7k tokensUpdated 19 days ago
    SecurityAuto-check passed

  • Codeql

    waybarrios/opencode-power-pack

    Run CodeQL database creation and security queries, add data-extension models, or process CodeQL SARIF.

    533 GitHub starsUsed in 2 repos~3.7k tokens
    SecurityAuto-check passed

  • Agentic GitHub Actions Auditor

    trailofbits/skills

    Official

    Statically audits GitHub Actions workflows that run AI coding agents, tracing attacker-controlled input to agent prompts and flagging unsafe sandbox, trigger and allowlist settings.

    7.4k GitHub starsUsed in 6 repos~5.4k tokens
    SecurityAuto-check: notes

  • Audit Prep

    PlamenTSV/plamen

    Prepare Solidity projects for a security audit — test coverage, test quality, NatSpec docs, code hygiene, dependency health, best-practice enforcement, deployment readiness, and project…

    303 GitHub stars~3.7k tokensUpdated 13 days ago
    SecurityAuto-check passed

More from utkusen/sast-skills

All 16 skills in this repo

  • Sast Graphql

    utkusen/sast-skills

    Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input…

    1.3k GitHub stars~4.7k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Idor

    utkusen/sast-skills

    Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3…

    1.3k GitHub stars~4.9k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Report

    utkusen/sast-skills

    Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact.

    1.3k GitHub stars~1.7k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Businesslogic

    utkusen/sast-skills

    Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel…

    1.3k GitHub stars~5.3k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Fileupload

    utkusen/sast-skills

    Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel…

    1.3k GitHub stars~7.3k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Hardcodedsecrets

    utkusen/sast-skills

    Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates.

    1.3k GitHub stars~6.5k tokensUpdated 6 mo ago
    Auto-check: notes

Categories

Questions about Sast Analysis

What does Sast Analysis do?

Perform codebase analysis and architecture mapping as the first phase of a security assessment. Sast Analysis is an agent skill from utkusen/sast-skills. Perform codebase analysis and architecture mapping as the first phase of a security assessment.

When should I use Sast Analysis?

Sast Analysis fits situations like: asked to analyze a codebase for security; sast/architecture.md does not yet exist.

How do I install Sast Analysis in Claude Code?

Run `npx skills add utkusen/sast-skills --skill sast-analysis -a claude-code`. Or copy the skill folder (sast-files/.agents/skills/sast-analysis in utkusen/sast-skills) into .claude/skills/sast-analysis in your project. Claude Code loads it when a task matches its description.

How do I install Sast Analysis in Codex?

Run `npx skills add utkusen/sast-skills --skill sast-analysis -a codex`. Or copy the skill folder (sast-files/.agents/skills/sast-analysis in utkusen/sast-skills) into .agents/skills/sast-analysis in your project. Codex loads it when a task matches its description.

Can I use Sast Analysis in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add utkusen/sast-skills --skill sast-analysis -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sast-analysis, .gemini/skills/sast-analysis, .github/skills/sast-analysis and .opencode/skills/sast-analysis in your project.

What does Sast Analysis need to run?

SKILL.md names no scripts, command-line tools or credentials: Sast Analysis is instructions for the agent only. Our summary lists: Docker.

Does Sast Analysis access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Sast Analysis safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Sast Analysis use?

Sast Analysis is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Sast Analysis use?

About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Sast Analysis?

Skills that share tags, products or a category with Sast Analysis: Semgrep Security Scan (trailofbits/skills, 7.4k stars), CodeCrucible Security Scans (block/codecrucible, 117 stars), Audit (vigolium/piolium, 140 stars) and Codeql (waybarrios/opencode-power-pack, 533 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Sast Analysis?

utkusen (a GitHub user) maintains it in utkusen/sast-skills, which has 1,329 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on April 8, 2026.

Source: utkusen/sast-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.