From rune
Runs static analysis tools like ESLint, Semgrep, Bandit, Clippy, govulncheck on JS/TS, Python, Rust, Go projects with unified severity output. Use for deep vulnerability and data flow analysis beyond regex patterns.
npx claudepluginhub rune-kit/rune --plugin @rune/analyticsThis skill uses the workspace's default tool permissions.
Unified static analysis tool runner. While `sentinel` does regex-based security pattern matching and `verification` runs lint/type/test/build, SAST goes deeper — running dedicated static analysis tools that understand data flow, taint tracking, and language-specific vulnerability patterns.
Performs Static Application Security Testing (SAST) to detect vulnerabilities like SQL injection, XSS, hardcoded secrets across Python, JavaScript/TypeScript, Java, Ruby, PHP, Go, Rust using Bandit, Semgrep, ESLint Security.
Scans code for vulnerabilities, bugs, and code smells using Semgrep and CodeQL. Run before releases, large PRs, or when suspecting recurrent bug classes.
Runs parallel Semgrep scans on multi-language codebases with full or security-focused modes. Auto-uses Pro for taint analysis; merges SARIF output.
Share bugs, ideas, or general feedback.
Unified static analysis tool runner. While sentinel does regex-based security pattern matching and verification runs lint/type/test/build, SAST goes deeper — running dedicated static analysis tools that understand data flow, taint tracking, and language-specific vulnerability patterns.
Sentinel catches obvious patterns (hardcoded secrets, SQL string concat). SAST catches subtle ones (tainted data flowing through 3 function calls to a sink, unsafe deserialization behind a wrapper).
sentinel (L2) when deep analysis needed beyond pattern matchingaudit (L2) during security dimension assessmentcook (L1) on security-sensitive code (auth, crypto, payments)/rune sast — manual static analysis scanNone — pure runner using Bash for all tools.
sentinel (L2): deep analysis beyond regex patternsaudit (L2): security dimension in full auditcook (L1): security-sensitive code pathsreview (L2): when security patterns detected in diffUse Glob to detect project language and available tools:
| Indicator | Language | Primary Tool | Fallback |
|---|---|---|---|
package.json | JavaScript/TypeScript | npx eslint --ext .js,.ts,.tsx | npx oxlint |
tsconfig.json | TypeScript | npx tsc --noEmit + ESLint | — |
pyproject.toml / setup.py | Python | bandit -r . -f json | ruff check --select S . |
Cargo.toml | Rust | cargo clippy -- -D warnings | cargo audit |
go.mod | Go | govulncheck ./... | go vet ./... |
.semgrep.yml / any | Any | semgrep --config auto | — |
Check tool availability:
Bash: command -v <tool> 2>/dev/null
→ If not installed: mark as SKIP with install instruction
→ If installed: proceed with scan
Run the detected primary tool on changed files (or full project if no diff):
For each available tool:
Bash: <tool command> 2>&1
→ Capture stdout + stderr
→ Parse output into unified format (see Step 4)
→ Record: exit code, finding count, execution time
Tool-specific commands:
# ESLint (JS/TS) — security-focused rules
npx eslint --no-eslintrc --rule '{"no-eval": "error", "no-implied-eval": "error"}' <files>
# Bandit (Python) — security scanner
bandit -r <path> -f json -ll # medium+ severity only
# Semgrep (any language) — pattern-based analysis
semgrep --config auto --json --severity ERROR --severity WARNING <path>
# Clippy (Rust) — lint + security
cargo clippy --all-targets -- -D warnings -W clippy::unwrap_used
# govulncheck (Go) — vulnerability check
govulncheck ./...
Semgrep provides cross-language analysis with community rules. Run regardless of primary language tool:
IF semgrep is installed:
Bash: semgrep --config auto --json <changed-files-or-project>
→ Parse JSON output
→ Map severity: error→BLOCK, warning→WARN, info→INFO
If semgrep is NOT installed, log INFO: "semgrep not installed — install with pip install semgrep for deeper cross-language analysis."
Map all tool outputs to unified severity:
BLOCK (must fix):
- Bandit: HIGH confidence + HIGH severity
- ESLint: error-level security rules
- Semgrep: ERROR severity
- Clippy: deny-level warnings
- govulncheck: any known vulnerability
WARN (should fix):
- Bandit: MEDIUM confidence or MEDIUM severity
- ESLint: warning-level rules
- Semgrep: WARNING severity
- Clippy: warn-level suggestions
INFO (informational):
- Bandit: LOW severity
- Semgrep: INFO severity
- Style/convention suggestions
## SAST Report
- **Status**: PASS | WARN | BLOCK
- **Tools Run**: [list with versions]
- **Tools Skipped**: [list with install instructions]
- **Files Scanned**: [count]
- **Findings**: [count by severity]
### BLOCK (must fix)
- `path/to/file.py:42` — [tool] Possible SQL injection via string formatting (B608)
- `path/to/auth.ts:15` — [semgrep] JWT token not verified before use
### WARN (should fix)
- `path/to/utils.py:88` — [bandit] Use of `subprocess` with shell=True (B602)
### INFO
- `path/to/config.ts:10` — [eslint] Prefer `const` over `let` for unchanging variable
### Tool Coverage
| Tool | Status | Findings | Duration |
|------|--------|----------|----------|
| ESLint | RAN | 2 WARN | 1.2s |
| Semgrep | SKIPPED | — | — (not installed) |
| Bandit | N/A | — | — (not Python) |
SAST Report with status (PASS/WARN/BLOCK), tools run, files scanned, findings by severity (BLOCK/WARN/INFO), and tool coverage table. See Step 5 Report above for full template.
| Failure Mode | Severity | Mitigation |
|---|---|---|
| Tool not installed → entire scan skipped silently | HIGH | Constraint 4: show install instruction, continue with available tools |
| Raw tool output dumped without normalization | MEDIUM | Step 4: always normalize to unified format |
| Only running one tool when multiple apply | MEDIUM | Constraint 1: run ALL available tools for the language |
| Semgrep community rules producing noise | LOW | Filter to ERROR+WARNING severity only — skip INFO-level Semgrep |
| Long-running scan on large codebase | MEDIUM | Run on changed files only when diff available, full scan only on manual invocation |
~300-800 tokens input, ~200-500 tokens output. Haiku + Bash commands. Tool execution time varies (1-30s depending on project size).