Description
sast-configuration is an agent skill from the wshobson/agents collection for setting up static application security testing (SAST) tools that find vulnerabilities in application code without running it. It covers Semgrep, SonarQube and CodeQL, and it explains how to configure them across several programming languages. The skill's uses include setting up SAST scanning in CI/CD pipelines so every change is checked, creating custom security rules that match the patterns of your own codebase, configuring quality gates and compliance policies that decide when a build should fail, optimizing scan speed, and reducing false positives so developers keep trusting the results. It also covers combining more than one SAST tool for defense in depth, since each tool catches some issues the others miss. The first section is a Semgrep configuration guide, covering rule files and how to write a custom rule. A static scanner is only useful when its findings are triaged, so the skill's guidance includes making rules specific enough that teams act on what they see. The agent writes the configuration files and rules for a project, and the security team decides which findings block a release. The skill is installed with the skills CLI from the wshobson/agents repository. Its skills.sh page showed about 10.5K installs and passing results from three security audits at the time of the scan.…
Highlights
- Semgrep, SonarQube and CodeQL configuration
- Custom security rule creation
- CI/CD scanning setup
- Quality gates and compliance policies
- Tuning to reduce false positives
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate sast-configuration.
People also visit
security-reviewer
Identifies security vulnerabilities, generates structured audit reports
sast-configuration FAQ
Which SAST tools are covered?
Semgrep, SonarQube and CodeQL.
Can I write my own rules?
Yes. The skill covers creating custom security rules for your codebase, starting with Semgrep rules.
Does it run in CI?
Yes. Setting up SAST scanning in CI/CD pipelines is one of its uses.
How are false positives handled?
The skill covers tuning rules and scans to reduce false positives so results stay useful.
How do I install it?
Run npx skills add https://github.com/wshobson/agents --skill sast-configuration.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best sast-configuration alternatives?
Popular alternatives to sast-configuration include codeql, security-reviewer and using-agent-skills. See all sast-configuration alternatives