Sast Skills — AI skill for Claude Code
Collection of agent skills that turn your AI coder into a SAST scanner.
How to install Sast Skills
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open utkusen/sast-skills and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What Sast Skills does
Collection of agent skills that turn your AI coder into a SAST scanner.
Alternatives in AI
- WeKnora — Open-source LLM knowledge platform: turn raw documents into a queryable RAG, an autonomous reasoning agent, an 26.9k ★
- Qwen Code — A command-line AI workflow tool adapted from Gemini CLI, optimized for Qwen3-Coder models with enhanced parser 20.8k ★
- WindsurfAPI — Turn Windsurf / Devin Desktop's 100+ AI models (Claude, GPT, Gemini, DeepSeek, Kimi, GLM, SWE) into OpenAI-, A 3k ★
README
LLM SAST Skills
A collection of agent skills that turn your LLM coding assistant into a fully functional SAST scanner to find vulnerabilities in your codebase. Works natively with Claude Code, Codex, Opencode, Cursor and any other assistant that supports agent skills. No third-party tools required.
Claude Code with Opus model is recommended. But if the cost is a concern, use any IDE and model you trust.
How It Works
`CLAUDE.md` (for Claude Code) or `AGENTS.md` (for Opencode and other IDEs) orchestrates the entire assessment workflow automatically. The assessment runs in three steps:
**Codebase Analysis** -- The `sast-analysis` skill maps the technology stack, architecture, entry points, data flows, and trust boundaries. It writes its findings to `sast/architecture.md`.
**Vulnerability Detection (parallel)** -- All 13 vulnerability detection skills run in parallel as subagents. Each skill follows a two-phase approach: first a recon/discovery phase to find candidate sections, then a verification phase to confirm exploitability. Results are written to `sast/*-results.md`.
**Report Generation** -- The `sast-report` skill consolidates all findings into a single `sast/final-report.md`, ranked by severity with full remediation guidance and dynamic test instructions.
What It Detects
| Skill | Vulnerability Class |
|---|---|
| sast-analysis | Codebase reconnaissance, architecture mapping, threat modeling |
| sast-sqli | SQL Injection |
| sast-graphql | GraphQL injection |
| sast-xss | Cross-Site Scripting (XSS) |
| sast-rce | Remote Code Execution (command injection, eval, unsafe deserialization) |
| sast-ssrf | Server-Side Request Forgery |
| sast-idor | Insecure Direct Object Reference |
| sast-xxe | XML External Entity |
| sast-ssti | Server-Side Template Injection |
| sast-jwt | Insecure JWT implementations |
| sast-missingauth | Missing authentication and broken function-level authorization |
| sast-pathtrav |
Related Skills
Coder Eval Code Review
Run a multi-model code review on uncommitted changes or a described set of files
Vibe Coder MCP
Vibe-Coder-MCP server extends AI assistants with specialized software development tools.
Coder Studio
Browser-based AI coding workspace for Claude Code and Codex. Run long tasks, supervise progress, and switch ac
Refresh Coder Comparison
Re-research the coder capability matrix — re-check benchmark boards, pricing, model rosters, safety evaluation
Select Coder
Recommend which coder agent and model should execute a coding task — probes locally available backends (opus,
Mythic Agent Coder CLI
Mythic CLI is a powerful, terminal-based Vibe Coding AI Operating System. Featuring a dual-layer Vector RAG su
Related Agents
Qe Security Scanner
Security scanning with SAST/DAST, vulnerability detection, and compliance validation
Security Sast
Static Application Security Testing (SAST) for comprehensive code vulnerability detection across mul... - wsho
Aspm Correlator
Application Security Posture Management persona. Correlates findings from SAST, DAST, and SCA tools, deduplica
