sast-analyzer
Static Application Security Testing orchestration and analysis. Execute Semgrep, Bandit, ESLint security plugins, CodeQL, and other SAST tools. Parse, prioritize, and deduplicate findings across multiple tools with remediation guidance.
npx skills add a5c-ai/babysitter --skill sast-analyzer --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# sast-analyzer You are **sast-analyzer** - a specialized skill for Static Application Security Testing (SAST) orchestration and analysis. This skill provides comprehensive capabilities for detecting security vulnerabilities in source code through static analysis. ## Overview This skill enables AI-powered SAST including: - Semgrep security rule execution and custom rule creation - Bandit Python security analysis - ESLint security plugin scanning for JavaScript/TypeScript - CodeQL advanced semantic analysis - Multi-tool result aggregation and deduplication - OWASP and CWE mapping for findings - Prioritized remediation guidance ## Prerequisites - Source code repository to scan - CLI tools installed: semgrep, bandit, eslint, codeql (as needed) - Node.js/npm for ESLint plugins - Python for Bandit ## Capabilities ### 1. Semgrep Security Scanning Execute Semgrep with comprehensive security rulesets: ```bash # Run with auto config (detects languages) semgrep scan --config auto --json > semgrep-results.json # Run OWASP Top 10 rules semgrep scan --config "p/owasp-top-ten" --json # Run language-specific security rules semgrep scan --config "p/python" --config "p/security-audit" . # Run with
- Overview
- Prerequisites
- Capabilities
- 1. Semgrep Security Scanning
- 2. Bandit Python Security Analysis
- 3. ESLint Security Scanning
- 4. CodeQL Analysis
- 5. Multi-Tool Aggregation
- 6. Custom Semgrep Rule Creation
- MCP Server Integration
- sast-mcp Features
- Best Practices
- Scanning Strategy
- Triage and Prioritization
Run with auto config (detects languages) semgrep scan --config auto --json > semgrep-results.json Run OWASP Top 10 rules semgrep scan --config "p/owasp-top-ten" --json Run language-specific security rules semgrep scan --config "p/python" --config "p/security-audit" . Run with custom rules semgrep scan --config ./custom-rules/ --json CI-friendly output with SARIF semgrep scan --config auto --sarif -o results.sarif
What does the sast-analyzer skill do?
Static Application Security Testing orchestration and analysis. Execute Semgrep, Bandit, ESLint security plugins, CodeQL, and other SAST tools. Parse, prioritize, and deduplicate findings across multiple tools with remediation guidance.
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill sast-analyzer --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.