Static Application Security Testing orchestration and analysis. Execute Semgrep, Bandit, ESLint security plugins, CodeQL, and other SAST tools. Parse, prioritize, and deduplicate findings across multiple tools with remediation guidance.
Orchestrates multiple SAST tools to analyze code security, deduplicate findings, and provide prioritized remediation guidance.
npx claudepluginhub a5c-ai/babysitterThis skill is limited to using the following tools:
README.mdYou are sast-analyzer - a specialized skill for Static Application Security Testing (SAST) orchestration and analysis. This skill provides comprehensive capabilities for detecting security vulnerabilities in source code through static analysis.
This skill enables AI-powered SAST including:
Execute Semgrep with comprehensive security rulesets:
# Run with auto config (detects languages)
semgrep scan --config auto --json > semgrep-results.json
# Run OWASP Top 10 rules
semgrep scan --config "p/owasp-top-ten" --json
# Run language-specific security rules
semgrep scan --config "p/python" --config "p/security-audit" .
# Run with custom rules
semgrep scan --config ./custom-rules/ --json
# CI-friendly output with SARIF
semgrep scan --config auto --sarif -o results.sarif
# Scan specific paths
semgrep scan --config auto --include="src/**" --exclude="**/test/**"
| Pack | Description | Use Case |
|---|---|---|
p/owasp-top-ten | OWASP Top 10 vulnerabilities | General web security |
p/security-audit | Comprehensive security audit | Deep security review |
p/ci | Fast, high-confidence rules | CI/CD pipelines |
p/secrets | Hardcoded secrets detection | Pre-commit checks |
p/python | Python-specific security | Python projects |
p/javascript | JavaScript security | JS/TS projects |
p/java | Java security rules | Java projects |
p/go | Go security rules | Go projects |
# Basic scan with JSON output
bandit -r ./src -f json -o bandit-results.json
# Scan with specific severity levels
bandit -r ./src -ll -ii -f json # medium and above
# Exclude test directories
bandit -r ./src --exclude ./tests,./venv -f json
# Run specific tests only
bandit -r ./src -t B101,B102,B103 -f json
# Generate SARIF output
bandit -r ./src -f sarif -o bandit.sarif
# Show only high severity
bandit -r ./src -lll -f json
| Test ID | Name | Severity |
|---|---|---|
| B101 | assert_used | Low |
| B102 | exec_used | Medium |
| B103 | set_bad_file_permissions | Medium |
| B104 | hardcoded_bind_all_interfaces | Medium |
| B105-B107 | hardcoded_passwords | Low |
| B108 | hardcoded_tmp_directory | Medium |
| B110 | try_except_pass | Low |
| B201 | flask_debug_true | High |
| B301-B303 | pickle/marshal | Medium |
| B501-B508 | SSL/TLS issues | High |
| B601-B602 | shell_injection | High |
| B608 | sql_injection | Medium |
# Install security plugins
npm install --save-dev eslint-plugin-security eslint-plugin-no-secrets
# Run ESLint with security rules
eslint --config .eslintrc.security.js --format json -o eslint-results.json src/
# Run with SARIF formatter
npx eslint --config .eslintrc.security.js --format @microsoft/eslint-formatter-sarif -o eslint.sarif src/
// .eslintrc.security.js
module.exports = {
plugins: ['security', 'no-secrets'],
extends: ['plugin:security/recommended'],
rules: {
'security/detect-object-injection': 'error',
'security/detect-non-literal-regexp': 'warn',
'security/detect-non-literal-fs-filename': 'warn',
'security/detect-eval-with-expression': 'error',
'security/detect-no-csrf-before-method-override': 'error',
'security/detect-possible-timing-attacks': 'warn',
'security/detect-pseudoRandomBytes': 'warn',
'security/detect-buffer-noassert': 'error',
'security/detect-child-process': 'warn',
'security/detect-disable-mustache-escape': 'error',
'security/detect-new-buffer': 'error',
'security/detect-unsafe-regex': 'error',
'no-secrets/no-secrets': ['error', { tolerance: 4.5 }]
}
};
# Create CodeQL database
codeql database create codeql-db --language=javascript --source-root=.
# Run security queries
codeql database analyze codeql-db \
codeql/javascript-queries:codeql-suites/javascript-security-extended.qls \
--format=sarif-latest \
--output=codeql-results.sarif
# Run for multiple languages
codeql database create codeql-db --language=javascript,python
# Run specific security queries
codeql database analyze codeql-db \
codeql/javascript-queries:Security/CWE-079/XssThroughDom.ql \
--format=json
| Suite | Coverage |
|---|---|
javascript-security-extended.qls | Extended JS security |
python-security-extended.qls | Extended Python security |
java-security-extended.qls | Extended Java security |
csharp-security-extended.qls | Extended C# security |
go-security-extended.qls | Extended Go security |
Combine and deduplicate results from multiple SAST tools:
# Run all tools and aggregate
semgrep scan --config auto --sarif -o semgrep.sarif
bandit -r ./src -f sarif -o bandit.sarif
eslint --format @microsoft/eslint-formatter-sarif -o eslint.sarif src/
# Parse and aggregate SARIF files
node aggregate-sarif.js semgrep.sarif bandit.sarif eslint.sarif > combined.json
{
"findings": [
{
"id": "finding-001",
"tool": "semgrep",
"rule_id": "python.lang.security.audit.dangerous-system-call",
"severity": "high",
"confidence": "high",
"cwe": ["CWE-78"],
"owasp": ["A03:2021"],
"file": "src/utils/exec.py",
"line": 42,
"column": 5,
"snippet": "os.system(user_input)",
"message": "Dangerous system call with user-controlled input",
"remediation": "Use subprocess.run with shell=False and explicit arguments",
"references": [
"https://cwe.mitre.org/data/definitions/78.html"
],
"duplicates": ["bandit-B602"],
"status": "open"
}
],
"summary": {
"total": 45,
"critical": 2,
"high": 8,
"medium": 15,
"low": 20,
"deduplicated": 12
}
}
# custom-rules/sql-injection.yaml
rules:
- id: custom-sql-injection
languages: [python]
severity: ERROR
message: >
Possible SQL injection vulnerability. User input '$INPUT'
is concatenated into SQL query.
patterns:
- pattern-either:
- pattern: |
$QUERY = "..." + $INPUT + "..."
$CURSOR.execute($QUERY)
- pattern: |
$CURSOR.execute("..." + $INPUT + "...")
- pattern: |
$CURSOR.execute(f"...{$INPUT}...")
metadata:
cwe: "CWE-89"
owasp: "A03:2021 - Injection"
confidence: HIGH
impact: HIGH
category: security
This skill can leverage the following MCP servers:
| Server | Description | Installation |
|---|---|---|
| sast-mcp | 23+ security tools integration | GitHub |
| Semgrep MCP | Official Semgrep integration | GitHub |
| SecOpsAgentKit | Multi-tool SAST orchestration | GitHub |
# GitHub Actions example
name: SAST Scan
on: [push, pull_request]
jobs:
sast:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Semgrep Scan
uses: returntocorp/semgrep-action@v1
with:
config: p/owasp-top-ten
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: semgrep.sarif
This skill integrates with the following processes:
sast-pipeline.js - CI/CD SAST integrationsecure-sdlc.js - Security in development lifecycledevsecops-pipeline.js - DevSecOps automationsecurity-code-review.js - Security-focused code reviewWhen executing operations, provide structured output:
{
"operation": "sast-scan",
"status": "completed",
"tools_executed": ["semgrep", "bandit", "eslint"],
"scan_duration_seconds": 45,
"summary": {
"total_findings": 32,
"by_severity": {
"critical": 1,
"high": 5,
"medium": 12,
"low": 14
},
"by_tool": {
"semgrep": 18,
"bandit": 8,
"eslint": 6
},
"deduplicated_count": 5
},
"top_issues": [
{
"rule": "sql-injection",
"count": 3,
"severity": "critical",
"files": ["src/db/queries.py", "src/api/users.py"]
}
],
"artifacts": ["semgrep.sarif", "bandit.json", "eslint.json", "combined-report.json"]
}
| Error | Cause | Resolution |
|---|---|---|
Rule not found | Invalid rule pack name | Verify rule pack exists |
Parse error | Syntax error in source | Check file encoding/syntax |
Timeout | Large codebase | Increase timeout or scan incrementally |
Memory exceeded | Too many files | Exclude generated/vendor files |
Activates when the user asks about AI prompts, needs prompt templates, wants to search for prompts, or mentions prompts.chat. Use for discovering, retrieving, and improving prompts.
Search, retrieve, and install Agent Skills from the prompts.chat registry using MCP tools. Use when the user asks to find skills, browse skill catalogs, install a skill for Claude, or extend Claude's capabilities with reusable AI agent components.
This skill should be used when the user wants to "create a skill", "add a skill to plugin", "write a new skill", "improve skill description", "organize skill content", or needs guidance on skill structure, progressive disclosure, or skill development best practices for Claude Code plugins.