How to use the SAST Configuration Guide agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file that gives an AI agent specialised instructions for a task. This skill is named sast-configuration and its description says it is for configuring SAST tools to detect vulnerabilities in application code, typically when you set up security scanning, adopt DevSecOps practices or automate code vulnerability detection.

Once installed, the agent can guide you through setting up Semgrep, SonarQube or CodeQL, writing custom security rules, wiring scans into CI/CD pipelines such as GitHub Actions, GitLab CI or Jenkins, and reducing false positives. The skill provides guidance and example commands. It does not scan your code by itself; scans run only when you run the tools.

• Semgrep: custom rules with pattern matching, language-specific security rules, CI/CD integration and false positive tuning
• SonarQube: quality gates, security hotspot analysis, custom quality profiles and LDAP/SAML integration
• CodeQL: GitHub Advanced Security integration, custom queries and SARIF result processing

How do you install the SAST Configuration skill?

Download the ZIP file for the skill from this page and unzip it. You can install it in one of two ways. For a personal setup that applies to all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills. The skill package contains one file, SKILL.md.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ in your project root
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What do you need before using it?

The guidance assumes you already have a codebase and a development workflow. Check which of these you have before you start, because the skill's examples depend on them.

• Python with pip, to install Semgrep
• Docker, for the SonarQube example
• GitHub CLI with the codeql extension, for CodeQL
• A CI/CD platform account such as GitHub, GitLab or Jenkins
• API tokens or credentials for your chosen SAST tool, if you use hosted or enterprise features

How do you trigger the skill with a natural request?

You do not need a special command. Describe what you want in plain language and mention the tool or the goal. The skill is meant to be used when you are setting up scanning, adding security checks to CI, or writing custom rules.

Good requests name the tool, the language and the target, for example asking the agent to add Semgrep to a Python repository with a GitHub Actions workflow. Vague requests still work, but the agent will need to ask you more questions first.

• "Set up Semgrep on this Python repo and tell me the commands to run."
• "Add a SAST scan to our GitHub Actions pipeline using the OWASP Top Ten rules."
• "Write a custom Semgrep rule that flags JWT secrets hardcoded in our code."
• "Help me tune out false positives from our last Semgrep run."
• "We need a PCI-DSS scan configured for our payments service."

What commands does the skill cover?

The skill includes example commands for each tool. Treat them as starting points and check them against the tool's own documentation before running them on real code. The examples below are quoted from the skill's guidance.

Semgrep installs with pip and runs with a config and an error flag. SonarQube runs in Docker on port 9000. CodeQL is installed as a GitHub CLI extension and creates a database for a language.

What does a CI/CD integration look like?

The skill shows a GitHub Actions step that runs Semgrep with the p/security-audit and p/owasp-top-ten rule sets. Ask the agent to adapt this to your GitLab CI or Jenkins setup if that is what you use. Review the generated workflow before committing it, since it will run in your pipeline with your permissions.

What about safety, scripts and network access?

This skill is marked as running scripts and using the network. Its guidance refers to a helper script, ./scripts/run-sast.sh, and to reference files such as references/semgrep-rules.md. Read any script before you run it, and check what network calls it makes. Tools such as SonarQube and hosted Semgrep features may need credentials, so keep API tokens out of committed files and store them in your CI secrets.

Because SAST only reads source code, it will not find runtime or configuration problems. Scan results still need expert review, and the skill does not replace a professional security audit.

• Read scripts such as run-sast.sh before executing them
• Store API tokens in CI secrets, not in the repository
• Confirm that any network access matches what you expect

What tips help you get useful results?

The skill's own best practices are a good checklist. Start with a baseline scan and prioritise critical and high findings. Add security rules first, then code quality rules, and block builds only for critical issues at the start. Document any suppressions and review them regularly. Exclude test files and generated code to cut noise.

• Run a baseline scan first and build a remediation list
• Begin with security rules and block only on critical findings
• Record suppressions and review them regularly
• Exclude tests and generated code from scans
• Use the troubleshooting advice for false positives, slow scans and integration failures