sast-patterns
Static Application Security Testing patterns, OWASP Top 10 checklist, language-specific vulnerability patterns, Semgrep rule writing guide, and CI/CD integration. Use when scanning code for security vulnerabilities or writing custom SAST rules.
npx skills add vibeeval/vibecosystem --skill sast-patterns --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Provides a comprehensive vulnerability pattern library for static application security testing, covering OWASP Top 10, language-specific patterns, Semgrep custom rules, and CI/CD integration. It is intended for use when scanning code for security vulnerabilities or writing custom SAST rules.
How it works
- Lists activation triggers such as running security scans, writing custom Semgrep rules, setting up CI/CD security gates, code review for security vulnerabilities, and events like sast-on-edit hooks or pre-production checks.
- Includes explicit detection content for each OWASP Top 10 category (A01–A10) with sample code patterns, detection rules, and, where applicable, Semgrep rule examples and regex-based detections.
- Provides a dedicated Semgrep Custom Rule Writing Guide with example rule structure, operators, metavariable constraints, taint analysis, and a sample project configuration.
- Contains a CI/CD integration section with GitHub Actions workflow example illustrating how to run Semgrep scans and generate SARIF reports as part of a security gate.
When to use it
- When running security scans on code
- When writing custom Semgrep rules
- When setting up CI/CD security gates
- When reviewing code for security vulnerabilities
- After sast-on-edit hook triggers
- Before production deployment
What it can touch
- Semgrep patterns and rule definitions (named in examples as patterns, pattern-inside, pattern-not-inside, pattern-regex, etc.)
- Detection patterns across JavaScript, Python, Go, Java samples, including regexes and code snippets
- CI/CD configuration via GitHub Actions workflow snippet for SAST scanning
Caveats
- License is MIT
- Declared tool: Claude Code
- The content is a library of patterns and examples; actual effectiveness depends on integration context and code base.
# SAST Patterns Skill Comprehensive vulnerability pattern library for static application security testing. Covers OWASP Top 10, language-specific patterns, Semgrep custom rules, and CI/CD pipeline integration. ## When to Activate - Running security scans on code - Writing custom Semgrep rules - Setting up CI/CD security gates - Reviewing code for security vulnerabilities - After sast-on-edit hook triggers - Before production deployment --- ## OWASP Top 10 (2021) Checklist ### A01: Broken Access Control **What to Look For:** - Missing authorization checks on endpoints - Direct object reference without ownership validation - CORS misconfiguration allowing wildcard origins - Missing function-level access control - Metadata manipulation (JWT, cookies, hidden fields) **Detection Patterns:** ```javascript // VULNERABLE: No authorization check app.get('/api/users/:id', async (req, res) => { const user = await db.users.findById(req.params.id) res.json(user) // Anyone can access any user }) // SECURE: Authorization verified app.get('/api/users/:id', authenticate, async (req, res) => { if (req.user.id !== req.params.id && !req.user.isAdmin) { return res.status(403).json({ error: 'Forbidden'
- When to Activate
- OWASP Top 10 (2021) Checklist
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable and Outdated Components
- A07: Identification and Authentication Failures
- A08: Software and Data Integrity Failures
- A09: Security Logging and Monitoring Failures
- A10: Server-Side Request Forgery (SSRF)
- Semgrep Custom Rule Writing Guide
- Basic Rule Structure
Node.js npm audit npm audit --json npm outdated Python pip-audit safety check pip list --outdated Go go list -m -u all
What does the sast-patterns skill do?
Static Application Security Testing patterns, OWASP Top 10 checklist, language-specific vulnerability patterns, Semgrep rule writing guide, and CI/CD integration. Use when scanning code for security vulnerabilities or writing custom SAST rules.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill sast-patterns --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.