Sast Skills

LLM SAST Skills

A collection of agent skills that turn your LLM coding assistant into a fully functional SAST scanner to find vulnerabilities in your codebase. Works natively with Claude Code, Codex, Opencode, Cursor and any other assistant that supports agent skills. No third-party tools required.

Claude Code with Opus model is recommended. But if the cost is a concern, use any IDE and model you trust.


How It Works

`CLAUDE.md` (for Claude Code) or `AGENTS.md` (for Opencode and other IDEs) orchestrates the entire assessment workflow automatically. The assessment runs in three steps:

1. **Codebase Analysis** -- The `sast-analysis` skill maps the technology stack, architecture, entry points, data flows, and trust boundaries. It writes its findings to `sast/architecture.md`.

2. **Vulnerability Detection (parallel)** -- All 13 vulnerability detection skills run in parallel as subagents. Each skill follows a two-phase approach: first a recon/discovery phase to find candidate sections, then a verification phase to confirm exploitability. Results are written to `sast/*-results.md`.

3. **Report Generation** -- The `sast-report` skill consolidates all findings into a single `sast/final-report.md`, ranked by severity with full remediation guidance and dynamic test instructions.

What It Detects

Skill	Vulnerability Class
sast-analysis	Codebase reconnaissance, architecture mapping, threat modeling
sast-sqli	SQL Injection
sast-graphql	GraphQL injection
sast-xss	Cross-Site Scripting (XSS)
sast-rce	Remote Code Execution (command injection, eval, unsafe deserialization)
sast-ssrf	Server-Side Request Forgery
sast-idor	Insecure Direct Object Reference
sast-xxe	XML External Entity
sast-ssti	Server-Side Template Injection
sast-jwt	Insecure JWT implementations
sast-missingauth	Missing authentication and broken function-level authorization
sast-pathtrav