skills.rest
simplerick0
simplerick0COMMUNITY
Explore all skills by this author →
GitHub

sast

Scan source code for security flaws and produce markdown findings.

Updated Jan 26, 2026
Search Tags:#static analysis#security#dependencies#secrets#vulnerabilities#code-review
One-click install
npx skills add https://github.com/simplerick0/com.ackhax.configs --skill sast
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast
Source: https://github.com/simplerick0/com.ackhax.configs/tree/main/skills/security/sast
Command: npx skills add https://github.com/simplerick0/com.ackhax.configs --skill sast

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SAST helps teams identify security flaws and insecure patterns in source code without executing it, reducing risk during development.

Core Features & Use Cases

  • Secret detection: Find hardcoded credentials, API keys, tokens, and private keys.
  • Injection and configuration flaws: Flag common injection vectors, insecure deserialization, and misconfigurations.
  • Dependency and build risk: Detect vulnerable or outdated dependencies and typosquatting risks.
  • Use Case: A software project can automatically scan a repository to surface secrets and insecure patterns, producing actionable remediation guidance.

Quick Start

Run a static code review on your project and review the generated findings report.

Frequently Asked Questions about sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a static security analysis to detect hardcoded secrets in my codebase?▼

Run a static security analysis to scan your repository and identify hardcoded credentials, API keys, and tokens. This process reviews code without execution, producing a structured markdown report with actionable remediation guidance.

What's the best way to scan source code for insecure patterns and configuration flaws?▼

Scanning source code for insecure patterns and configuration flaws involves analyzing code and project configurations without execution. This method flags injection vectors, insecure deserialization, and misconfigurations, generating a structured markdown report of findings.

Can I use static analysis to check dependency manifests for vulnerable or outdated packages?▼

Yes, you can use static analysis to check dependency manifests for vulnerable or outdated packages. This process detects dependency risks, including typosquatting, by scanning manifests and build configurations to produce a structured findings report.

Does static code review work for finding security flaws across different programming languages?▼

Static code review works across different programming languages to identify security flaws. By analyzing code, dependency manifests, and project configurations, it surfaces insecure patterns and generates actionable remediation guidance in a structured markdown format.

What types of security flaws can a static code review identify without executing the code?▼

A static code review can identify hardcoded secrets, injection vectors, insecure deserialization, misconfigurations, and vulnerable dependencies without executing the code. It scans code and manifests to produce a structured markdown report of these findings.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

code-security-auditor

Audit codebases with static analysis and generate structured risk reports.

Community
Advanced
eleva-labseleva-labs

security-audit

Plan security audits with checklists for dependency scanning and secret detection.

Official
Basic
iani-kuliiani-kuli

secret-guard

Block hardcoded credentials and API keys during git commit workflows.

Community
Advanced
Ed1s0nZEd1s0nZ
5.6k

mobile-app-security-testing

Analyze Android and iOS applications for security vulnerabilities using static and dynamic techniques.

Community
Advanced