Skip to content
Get packs

SAST Configuration Guide

Set up Semgrep, SonarQube or CodeQL to automatically scan code for security vulnerabilities

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
1 file

What it does

Teaches the agent how to set up and configure static application security testing (SAST) tools, which scan source code for security flaws without running it. Once installed, the agent can walk you through installing Semgrep, SonarQube or CodeQL, writing custom security rules, wiring scans into CI/CD pipelines such as GitHub Actions, and tuning out false positives. It provides guidance and example commands; it does not itself scan your code unless you run the tools.

Great for

  • Developers or DevOps engineers adding automated security scanning to a repository or CI pipeline
  • Security teams writing custom Semgrep rules for their own codebase
  • Teams preparing for compliance checks such as PCI-DSS or SOC 2 who need scan configuration

Skip it if

  • Dynamic testing of running applications (SAST only analyses source code, so it will not find runtime or configuration issues)
  • Non-technical users who have no codebase or CI system to attach scans to, since the guidance assumes existing development workflows
  • Replacing a professional security audit: the skill is setup guidance, and scan results still need expert review

Try asking

  • “Set up Semgrep in my GitHub Actions workflow with the OWASP top ten rules”
  • “Write a custom Semgrep rule that flags hardcoded JWT secrets in our Python code”
  • “Help me configure a SonarQube quality gate that blocks merges on critical security issues”
  • “Add a pre-commit hook that runs Semgrep before each commit”
Step-by-step guide: how to use SAST Configuration GuideInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    sast-configuration.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip sast-configuration.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip sast-configuration.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Start with a baseline scan and only block builds on critical findings, then tighten gradually to avoid developer frustration.
  • Review any scripts (for example ./scripts/run-sast.sh referenced in the skill) and any commands the agent proposes before running them, especially those that pull packages or containers from the internet.
  • Ask the agent for your language and CI platform up front so it tailors the rules and pipeline configuration to your stack.

What's inside

  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.