New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Sast Report

by utkusen in utkusen/sast-skills

Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact.

MITAuto-check passedSecurity

Install Sast Report

skills CLI
$ npx skills add utkusen/sast-skills --skill sast-report -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install utkusen/sast-skills sast-report --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/utkusen/sast-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/sast-files/.agents/skills/sast-report .claude/skills/sast-report && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
sast-report
GitHub stars
1.3k
Token cost
~1.7k tokens
SKILL.md length
530 words
Files
1
Skills in repo
16
Repo updated
First seen
Licence
MIT

At a glance

Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact.

  • Works in 4 steps: Discover result files → Read and extract findings → Score and sort → …
  • Asked to generate a final report
  • SKILL.md covers What to Include, Severity Ranking, Execution and Important Reminders
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Sast Report is an agent skill from utkusen/sast-skills. Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all -results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to generate a final report, consolidate findings, or summarize security results.

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Static analysis and SAST. The repository describes itself as: Collection of agent skills to find vulnerabilities inside your web/mobile apps. The licence is MIT.

When your agent uses it

  • Asked to generate a final report
  • Consolidate findings
  • Summarize security results

Example prompts

  • “/sast-report”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Discover result files
  2. Read and extract findings
  3. Score and sort
  4. Write sast/final-report.md

What it can do on your machine

Read from SKILL.md and the folder at commit db52227. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sast Report loads about 1.7k tokens when it runs. Until then it costs about 91 tokens; SKILL.md has 530 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~91
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from utkusen/sast-skills at commit db52227, republished under its MIT licence (© utkusen). 530 words, ~1,747 tokens.

Download SKILL.mdSave it as .claude/skills/sast-report/SKILL.md (or your agent's skills folder).
name
sast-report
description
Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to generate a final report, consolidate findings, or summarize security results.

Final Security Report Generation

You are consolidating all completed SAST vulnerability scan results into a single prioritized security report.

Prerequisites: At least one sast/*-results.md file must exist. Run the vulnerability detection skills first if they don't.

What to Include

Only include findings with these classifications from each result file:

  • [VULNERABLE]
  • [LIKELY VULNERABLE]

Exclude [NOT VULNERABLE] and [NEEDS MANUAL REVIEW] findings from the main report body (count them only in the summary).

Severity Ranking

Assign each finding a severity tier — Critical, High, Medium, or Low — using the table below as your baseline. Adjust up or down based on context (e.g., an IDOR that exposes financial records is High, not Medium).

Vulnerability ClassDefault Severity
RCE via command injection, eval, or unsafe deserializationCritical
SSTI (Server-Side Template Injection)Critical
SQLi on authentication endpointsCritical
JWT algorithm confusion (alg:none, RS256→HS256)Critical
File upload leading to code execution (webshell)Critical
SQLi with full data extraction capabilityHigh–Critical
GraphQL injection (user-controlled operation document enabling unauthorized fields or gateway abuse)High–Critical
XXE with file read or internal SSRFHigh–Critical
Missing authentication on sensitive endpointsHigh–Critical
SSRF reaching internal services or cloud metadataHigh
Path traversal reading sensitive or config filesHigh
File upload with stored content accessible to othersHigh
IDOR on PII, financial, or health dataHigh
XSS (stored/persistent)High
JWT with missing or bypassable claim validationMedium–High
Missing authentication on lower-sensitivity endpointsMedium
IDOR on non-sensitive dataMedium
XSS (reflected or DOM)Medium
Business logic flaws (price manipulation, workflow bypass)Medium
Information disclosure of non-sensitive dataLow

Confidentiality as a tiebreaker: When two findings share the same baseline severity, rank higher the one with greater confidentiality impact — i.e., the greater its potential to expose sensitive user data, credentials, or system internals.

Execution

Perform all steps in-session (no subagents needed).

Step 1: Discover result files

Check which of these files exist in sast/:

  • idor-results.md
  • sqli-results.md
  • ssrf-results.md
  • xss-results.md
  • rce-results.md
  • xxe-results.md
  • fileupload-results.md
  • pathtraversal-results.md
  • ssti-results.md
  • jwt-results.md
  • missingauth-results.md
  • businesslogic-results.md
  • graphql-results.md

Also read sast/architecture.md if it exists (use it for the project name and context when writing severity rationale).

Show full SKILL.md (191 more words)Show less
Step 2: Read and extract findings

Read each existing result file. For every finding classified as [VULNERABLE] or [LIKELY VULNERABLE], extract:

  • Finding title
  • Vulnerability type (derived from the source file)
  • File / endpoint affected
  • Issue description
  • Impact description
  • Proof / code path
  • Remediation
  • Dynamic test steps (if present)
Step 3: Score and sort

Assign each finding a severity level (Critical / High / Medium / Low) using the table above. Sort all findings:

  1. Critical first, then High, Medium, Low
  2. Within each tier, sort by confidentiality impact (highest first)
Step 4: Write sast/final-report.md

Use exactly this output format:

markdown
# Security Assessment Final Report

**Project**: [name from architecture.md, or infer from codebase]
**Generated**: [current date]
**Scans completed**: [comma-separated list of scan types that had result files]

---

## Executive Summary

| Severity | Count |
|----------|-------|
| Critical | N |
| High     | N |
| Medium   | N |
| Low      | N |
| **Total confirmed findings** | **N** |

Scans with no confirmed vulnerabilities: [list]
Findings requiring manual review: N (see individual result files for details)

---

## Vulnerability Index

| # | Title | Type | Severity | Endpoint / File |
|---|-------|------|----------|----------------|
| 1 | ... | RCE | Critical | `POST /api/exec` |
| 2 | ... | SQLi | High | `GET /api/users` |

---

## Findings

### Critical

#### [Finding Title] — [Vuln Type]

- **Source scan**: `sast/[type]-results.md`
- **Classification**: Vulnerable *(or "Likely Vulnerable")*
- **Endpoint / File**: ...
- **Severity rationale**: [1–2 sentences explaining why this is Critical, with focus on confidentiality and integrity impact]
- **Issue**: ...
- **Impact**: ...
- **Proof**:

[code path or evidence from original finding]

- **Remediation**: ...
- **Dynamic Test**:

[curl command or step-by-step test instructions from original finding]


---

### High

[Same structure as Critical section]

---

### Medium

[Same structure]

---

### Low

[Same structure]

---

## Appendix: Scan Coverage

| Scan | Result File | Status |
|------|-------------|--------|
| IDOR | `sast/idor-results.md` | Completed / Not run |
| SQLi | `sast/sqli-results.md` | Completed / Not run |
| SSRF | `sast/ssrf-results.md` | Completed / Not run |
| XSS | `sast/xss-results.md` | Completed / Not run |
| RCE | `sast/rce-results.md` | Completed / Not run |
| XXE | `sast/xxe-results.md` | Completed / Not run |
| File Upload | `sast/fileupload-results.md` | Completed / Not run |
| Path Traversal | `sast/pathtraversal-results.md` | Completed / Not run |
| SSTI | `sast/ssti-results.md` | Completed / Not run |
| JWT | `sast/jwt-results.md` | Completed / Not run |
| Missing Auth | `sast/missingauth-results.md` | Completed / Not run |
| Business Logic | `sast/businesslogic-results.md` | Completed / Not run |
| GraphQL injection | `sast/graphql-results.md` | Completed / Not run |

Important Reminders

  • Include ONLY [VULNERABLE] and [LIKELY VULNERABLE] findings in the Findings section.
  • Mark [LIKELY VULNERABLE] findings clearly: append ⚠ Likely Vulnerable after the finding title.
  • Preserve all details from the original findings — do not summarize or truncate Proof, Remediation, or Dynamic Test sections.
  • If sast/architecture.md exists, use it to enrich the severity rationale with application-specific context (e.g., "this endpoint handles payment data, making confidentiality impact Critical").
  • Omit severity sections entirely (e.g., the ### Low heading) if no findings fall in that tier.

© utkusen, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in sast-files/.agents/skills/sast-report of utkusen/sast-skills.

Open the folder on GitHubat commit db52227

Compare with similar skills

Sast Report next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Sast Report compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Sast Report this skillutkusen/sast-skills1.3k—~1.7kAutomated safety check: PassMIT
Semgrepvigolium/piolium1401 repos~2.4kAutomated safety check: NotesMIT
C To AstNarwhal-Lab/MagicSkills316—~1.1kAutomated safety check: PassMIT
Semgrep Security Scantrailofbits/skills7.5k—~3.7kAutomated safety check: NotesCC-BY-SA-4.0
LLM Sast ScannerSunWeb3Sec/llm-sast-scanner288—~6.2kAutomated safety check: PassNone
Sast SemgrepAgentSecOps/SecOpsAgentKit2202 repos~2.4kAutomated safety check: PassCustom licence

Similar skills

  • Semgrep

    vigolium/piolium

    Run Semgrep static analysis scan on a codebase using parallel subagents.

    140 GitHub starsUsed in 1 repo~2.4k tokens
    SecurityAuto-check: notes

  • C To Ast

    Narwhal-Lab/MagicSkills

    Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.

    316 GitHub stars~1.1k tokensUpdated 6 mo ago
    SecurityAuto-check passed

  • Semgrep Security Scan

    trailofbits/skills

    Official

    Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.

    7.5k GitHub stars~3.7k tokensUpdated today
    SecurityAuto-check: notes

  • LLM Sast Scanner

    SunWeb3Sec/llm-sast-scanner

    General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.

    288 GitHub stars~6.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Sast Semgrep

    AgentSecOps/SecOpsAgentKit

    Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping.

    220 GitHub starsUsed in 2 repos~2.4k tokens
    SecurityAuto-check passed

  • Wp Phpstan

    Automattic/agent-skills

    A skill your agent uses when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and…

    211 GitHub starsUsed in 1 repo~1k tokens
    SecurityAuto-check passed

More from utkusen/sast-skills

All 16 skills in this repo

  • Sast Analysis

    utkusen/sast-skills

    Perform codebase analysis and architecture mapping as the first phase of a security assessment.

    1.3k GitHub stars~1k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Graphql

    utkusen/sast-skills

    Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input…

    1.3k GitHub stars~4.7k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Idor

    utkusen/sast-skills

    Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3…

    1.3k GitHub stars~4.9k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Businesslogic

    utkusen/sast-skills

    Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel…

    1.3k GitHub stars~5.3k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Fileupload

    utkusen/sast-skills

    Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel…

    1.3k GitHub stars~7.3k tokensUpdated 6 mo ago
    Auto-check passed

  • Sast Hardcodedsecrets

    utkusen/sast-skills

    Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates.

    1.3k GitHub stars~6.5k tokensUpdated 6 mo ago
    Auto-check: notes

Categories

Questions about Sast Report

What does Sast Report do?

Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Sast Report is an agent skill from utkusen/sast-skills. Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact.

When should I use Sast Report?

Sast Report fits situations like: asked to generate a final report; consolidate findings; summarize security results.

How do I install Sast Report in Claude Code?

Run `npx skills add utkusen/sast-skills --skill sast-report -a claude-code`. Or copy the skill folder (sast-files/.agents/skills/sast-report in utkusen/sast-skills) into .claude/skills/sast-report in your project. Claude Code loads it when a task matches its description.

How do I install Sast Report in Codex?

Run `npx skills add utkusen/sast-skills --skill sast-report -a codex`. Or copy the skill folder (sast-files/.agents/skills/sast-report in utkusen/sast-skills) into .agents/skills/sast-report in your project. Codex loads it when a task matches its description.

Can I use Sast Report in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add utkusen/sast-skills --skill sast-report -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sast-report, .gemini/skills/sast-report, .github/skills/sast-report and .opencode/skills/sast-report in your project.

What does Sast Report need to run?

SKILL.md names no scripts, command-line tools or credentials: Sast Report is instructions for the agent only.

Does Sast Report access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Sast Report safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Sast Report use?

Sast Report is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Sast Report use?

About 1.7k tokens (SKILL.md is roughly 7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Sast Report?

Skills that share tags, products or a category with Sast Report: Semgrep (vigolium/piolium, 140 stars), C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Semgrep Security Scan (trailofbits/skills, 7.5k stars) and LLM Sast Scanner (SunWeb3Sec/llm-sast-scanner, 288 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Sast Report?

utkusen (a GitHub user) maintains it in utkusen/sast-skills, which has 1,331 GitHub stars. The repository holds 16 skills in this directory. The repository was last updated on April 8, 2026.

Source: utkusen/sast-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.