{"id":"57291c91-cd70-4be2-9ebf-1ffb25422179","shortId":"d29LpR","kind":"skill","title":"security-scanning-security-sast","tagline":"'Static Application Security Testing (SAST) for code vulnerability","description":"# SAST Security Plugin\n\nStatic Application Security Testing (SAST) for comprehensive code vulnerability detection across multiple languages, frameworks, and security patterns.\n\n## Capabilities\n\n- **Multi-language SAST**: Python, JavaScript/TypeScript, Java, Ruby, PHP, Go, Rust\n- **Tool integration**: Bandit, Semgrep, ESLint Security, SonarQube, CodeQL, PMD, SpotBugs, Brakeman, gosec, cargo-clippy\n- **Vulnerability patterns**: SQL injection, XSS, hardcoded secrets, path traversal, IDOR, CSRF, insecure deserialization\n- **Framework analysis**: Django, Flask, React, Express, Spring Boot, Rails, Laravel\n- **Custom rule authoring**: Semgrep pattern development for organization-specific security policies\n\n## Use this skill when\n\nUse for code review security analysis, injection vulnerabilities, hardcoded secrets, framework-specific patterns, custom security policy enforcement, pre-deployment validation, legacy code assessment, and compliance (OWASP, PCI-DSS, SOC2).\n\n**Specialized tools**: Use `security-secrets.md` for advanced credential scanning, `security-owasp.md` for Top 10 mapping, `security-api.md` for REST/GraphQL endpoints.\n\n## Do not use this skill when\n\n- You only need runtime testing or penetration testing\n- You cannot access the source code or build outputs\n- The environment forbids third-party scanning tools\n\n## Instructions\n\n1. Identify the languages, frameworks, and scope to scan.\n2. Select SAST tools and configure rules for the codebase.\n3. Run scans in CI or locally with reproducible settings.\n4. Triage findings, prioritize by severity, and propose fixes.\n\n## Safety\n\n- Avoid uploading proprietary code to external services without approval.\n- Require review before enabling auto-fix or blocking releases.\n\n## SAST Tool Selection\n\n### Python: Bandit\n\n```bash\n# Installation & scan\npip install bandit\nbandit -r . -f json -o bandit-report.json\nbandit -r . -ll -ii -f json  # High/Critical only\n```\n\n**Configuration**: `.bandit`\n```yaml\nexclude_dirs: ['/tests/', '/venv/', '/.tox/', '/build/']\ntests: [B201, B301, B302, B303, B304, B305, B307, B308, B312, B323, B324, B501, B502, B506, B602, B608]\nskips: [B101]\n```\n\n### JavaScript/TypeScript: ESLint Security\n\n```bash\nnpm install --save-dev eslint @eslint/plugin-security eslint-plugin-no-secrets\neslint . --ext .js,.jsx,.ts,.tsx --format json > eslint-security.json\n```\n\n**Configuration**: `.eslintrc-security.json`\n```json\n{\n  \"plugins\": [\"@eslint/plugin-security\", \"eslint-plugin-no-secrets\"],\n  \"extends\": [\"plugin:security/recommended\"],\n  \"rules\": {\n    \"security/detect-object-injection\": \"error\",\n    \"security/detect-non-literal-fs-filename\": \"error\",\n    \"security/detect-eval-with-expression\": \"error\",\n    \"security/detect-pseudo-random-prng\": \"error\",\n    \"no-secrets/no-secrets\": \"error\"\n  }\n}\n```\n\n### Multi-Language: Semgrep\n\n```bash\npip install semgrep\nsemgrep --config=auto --json --output=semgrep-report.json\nsemgrep --config=p/security-audit --json\nsemgrep --config=p/owasp-top-ten --json\nsemgrep ci --config=auto  # CI mode\n```\n\n**Custom Rules**: `.semgrep.yml`\n```yaml\nrules:\n  - id: sql-injection-format-string\n    pattern: cursor.execute(\"... %s ...\" % $VAR)\n    message: SQL injection via string formatting\n    severity: ERROR\n    languages: [python]\n    metadata:\n      cwe: \"CWE-89\"\n      owasp: \"A03:2021-Injection\"\n\n  - id: dangerous-innerHTML\n    pattern: $ELEM.innerHTML = $VAR\n    message: XSS via innerHTML assignment\n    severity: ERROR\n    languages: [javascript, typescript]\n    metadata:\n      cwe: \"CWE-79\"\n\n  - id: hardcoded-aws-credentials\n    patterns:\n      - pattern: $KEY = \"AKIA...\"\n      - metavariable-regex:\n          metavariable: $KEY\n          regex: \"(aws_access_key_id|AWS_ACCESS_KEY_ID)\"\n    message: Hardcoded AWS credentials detected\n    severity: ERROR\n    languages: [python, javascript, java]\n\n  - id: path-traversal-open\n    patterns:\n      - pattern: open($PATH, ...)\n      - pattern-not: open(os.path.join(SAFE_DIR, ...), ...)\n      - metavariable-pattern:\n          metavariable: $PATH\n          patterns:\n            - pattern: $REQ.get(...)\n    message: Path traversal via user input\n    severity: ERROR\n    languages: [python]\n\n  - id: command-injection\n    patterns:\n      - pattern-either:\n          - pattern: os.system($CMD)\n          - pattern: subprocess.call($CMD, shell=True)\n      - metavariable-pattern:\n          metavariable: $CMD\n          patterns:\n            - pattern-either:\n                - pattern: $X + $Y\n                - pattern: f\"...{$VAR}...\"\n    message: Command injection via shell=True\n    severity: ERROR\n    languages: [python]\n```\n\n### Other Language Tools\n\n**Java**: `mvn spotbugs:check`\n**Ruby**: `brakeman -o report.json -f json`\n**Go**: `gosec -fmt=json -out=gosec.json ./...`\n**Rust**: `cargo clippy -- -W clippy::unwrap_used`\n\n## Vulnerability Patterns\n\n### SQL Injection\n\n**VULNERABLE**: String formatting/concatenation with user input in SQL queries\n\n**SECURE**:\n```python\n# Parameterized queries\ncursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))\nUser.objects.filter(id=user_id)  # ORM\n```\n\n### Cross-Site Scripting (XSS)\n\n**VULNERABLE**: Direct HTML manipulation with unsanitized user input (innerHTML, outerHTML, document.write)\n\n**SECURE**:\n```javascript\n// Use textContent for plain text\nelement.textContent = userInput;\n\n// React auto-escapes\n<div>{userInput}</div>\n\n// Sanitize when HTML required\nimport DOMPurify from 'dompurify';\nelement.innerHTML = DOMPurify.sanitize(userInput);\n```\n\n### Hardcoded Secrets\n\n**VULNERABLE**: Hardcoded API keys, passwords, tokens in source code\n\n**SECURE**:\n```python\nimport os\nAPI_KEY = os.environ.get('API_KEY')\nPASSWORD = os.getenv('DB_PASSWORD')\n```\n\n### Path Traversal\n\n**VULNERABLE**: Opening files using unsanitized user input\n\n**SECURE**:\n```python\nimport os\nALLOWED_DIR = '/var/www/uploads'\nfile_name = request.args.get('file')\nfile_path = os.path.join(ALLOWED_DIR, file_name)\nfile_path = os.path.realpath(file_path)\nif not file_path.startswith(os.path.realpath(ALLOWED_DIR)):\n    raise ValueError(\"Invalid file path\")\nwith open(file_path, 'r') as f:\n    content = f.read()\n```\n\n### Insecure Deserialization\n\n**VULNERABLE**: pickle.loads(), yaml.load() with untrusted data\n\n**SECURE**:\n```python\nimport json\ndata = json.loads(user_input)  # SECURE\nimport yaml\nconfig = yaml.safe_load(user_input)  # SECURE\n```\n\n### Command Injection\n\n**VULNERABLE**: os.system() or subprocess with shell=True and user input\n\n**SECURE**:\n```python\nsubprocess.run(['ping', '-c', '4', user_input])  # Array args\nimport shlex\nsafe_input = shlex.quote(user_input)  # Input validation\n```\n\n### Insecure Random\n\n**VULNERABLE**: random module for security-critical operations\n\n**SECURE**:\n```python\nimport secrets\ntoken = secrets.token_hex(16)\nsession_id = secrets.token_urlsafe(32)\n```\n\n## Framework Security\n\n### Django\n\n**VULNERABLE**: @csrf_exempt, DEBUG=True, weak SECRET_KEY, missing security middleware\n\n**SECURE**:\n```python\n# settings.py\nDEBUG = False\nSECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')\n\nMIDDLEWARE = [\n    'django.middleware.security.SecurityMiddleware',\n    'django.middleware.csrf.CsrfViewMiddleware',\n    'django.middleware.clickjacking.XFrameOptionsMiddleware',\n]\n\nSECURE_SSL_REDIRECT = True\nSESSION_COOKIE_SECURE = True\nCSRF_COOKIE_SECURE = True\nX_FRAME_OPTIONS = 'DENY'\n```\n\n### Flask\n\n**VULNERABLE**: debug=True, weak secret_key, CORS wildcard\n\n**SECURE**:\n```python\nimport os\nfrom flask_talisman import Talisman\n\napp.secret_key = os.environ.get('FLASK_SECRET_KEY')\nTalisman(app, force_https=True)\nCORS(app, origins=['https://example.com'])\n```\n\n### Express.js\n\n**VULNERABLE**: Missing helmet, CORS wildcard, no rate limiting\n\n**SECURE**:\n```javascript\nconst helmet = require('helmet');\nconst rateLimit = require('express-rate-limit');\n\napp.use(helmet());\napp.use(cors({ origin: 'https://example.com' }));\napp.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));\n```\n\n## Multi-Language Scanner Implementation\n\n```python\nimport json\nimport subprocess\nfrom pathlib import Path\nfrom typing import Dict, List, Any\nfrom dataclasses import dataclass\nfrom datetime import datetime\n\n@dataclass\nclass SASTFinding:\n    tool: str\n    severity: str\n    category: str\n    title: str\n    description: str\n    file_path: str\n    line_number: int\n    cwe: str\n    owasp: str\n    confidence: str\n\nclass MultiLanguageSASTScanner:\n    def __init__(self, project_path: str):\n        self.project_path = Path(project_path)\n        self.findings: List[SASTFinding] = []\n\n    def detect_languages(self) -> List[str]:\n        \"\"\"Auto-detect languages\"\"\"\n        languages = []\n        indicators = {\n            'python': ['*.py', 'requirements.txt'],\n            'javascript': ['*.js', 'package.json'],\n            'typescript': ['*.ts', 'tsconfig.json'],\n            'java': ['*.java', 'pom.xml'],\n            'ruby': ['*.rb', 'Gemfile'],\n            'go': ['*.go', 'go.mod'],\n            'rust': ['*.rs', 'Cargo.toml'],\n        }\n        for lang, patterns in indicators.items():\n            for pattern in patterns:\n                if list(self.project_path.glob(f'**/{pattern}')):\n                    languages.append(lang)\n                    break\n        return languages\n\n    def run_comprehensive_sast(self) -> Dict[str, Any]:\n        \"\"\"Execute all applicable SAST tools\"\"\"\n        languages = self.detect_languages()\n\n        scan_results = {\n            'timestamp': datetime.now().isoformat(),\n            'languages': languages,\n            'tools_executed': [],\n            'findings': []\n        }\n\n        self.run_semgrep_scan()\n        scan_results['tools_executed'].append('semgrep')\n\n        if 'python' in languages:\n            self.run_bandit_scan()\n            scan_results['tools_executed'].append('bandit')\n        if 'javascript' in languages or 'typescript' in languages:\n            self.run_eslint_security_scan()\n            scan_results['tools_executed'].append('eslint-security')\n\n        scan_results['findings'] = [vars(f) for f in self.findings]\n        scan_results['summary'] = self.generate_summary()\n        return scan_results\n\n    def run_semgrep_scan(self):\n        \"\"\"Run Semgrep\"\"\"\n        for ruleset in ['auto', 'p/security-audit', 'p/owasp-top-ten']:\n            try:\n                result = subprocess.run([\n                    'semgrep', '--config', ruleset, '--json', '--quiet',\n                    str(self.project_path)\n                ], capture_output=True, text=True, timeout=300)\n\n                if result.stdout:\n                    data = json.loads(result.stdout)\n                    for f in data.get('results', []):\n                        self.findings.append(SASTFinding(\n                            tool='semgrep',\n                            severity=f.get('extra', {}).get('severity', 'MEDIUM').upper(),\n                            category='sast',\n                            title=f.get('check_id', ''),\n                            description=f.get('extra', {}).get('message', ''),\n                            file_path=f.get('path', ''),\n                            line_number=f.get('start', {}).get('line', 0),\n                            cwe=f.get('extra', {}).get('metadata', {}).get('cwe', ''),\n                            owasp=f.get('extra', {}).get('metadata', {}).get('owasp', ''),\n                            confidence=f.get('extra', {}).get('metadata', {}).get('confidence', 'MEDIUM')\n                        ))\n            except Exception as e:\n                print(f\"Semgrep {ruleset} failed: {e}\")\n\n    def generate_summary(self) -> Dict[str, Any]:\n        \"\"\"Generate statistics\"\"\"\n        severity_counts = {'CRITICAL': 0, 'HIGH': 0, 'MEDIUM': 0, 'LOW': 0}\n        for f in self.findings:\n            severity_counts[f.severity] = severity_counts.get(f.severity, 0) + 1\n\n        return {\n            'total_findings': len(self.findings),\n            'severity_breakdown': severity_counts,\n            'risk_score': self.calculate_risk_score(severity_counts)\n        }\n\n    def calculate_risk_score(self, severity_counts: Dict[str, int]) -> int:\n        \"\"\"Risk score 0-100\"\"\"\n        weights = {'CRITICAL': 10, 'HIGH': 7, 'MEDIUM': 4, 'LOW': 1}\n        total = sum(weights[s] * c for s, c in severity_counts.items())\n        return min(100, int((total / 50) * 100))\n```\n\n## CI/CD Integration\n\n### GitHub Actions\n\n```yaml\nname: SAST Scan\non:\n  pull_request:\n    branches: [main]\n\njobs:\n  sast:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v3\n      - uses: actions/setup-python@v4\n        with:\n          python-version: '3.11'\n\n      - name: Install tools\n        run: |\n          pip install bandit semgrep\n          npm install -g eslint @eslint/plugin-security\n\n      - name: Run scans\n        run: |\n          bandit -r . -f json -o bandit.json || true\n          semgrep --config=auto --json --output=semgrep.json || true\n\n      - name: Upload reports\n        uses: actions/upload-artifact@v3\n        with:\n          name: sast-reports\n          path: |\n            bandit.json\n            semgrep.json\n```\n\n### GitLab CI\n\n```yaml\nsast:\n  stage: test\n  image: python:3.11\n  script:\n    - pip install bandit semgrep\n    - bandit -r . -f json -o bandit.json || true\n    - semgrep --config=auto --json --output=semgrep.json || true\n  artifacts:\n    reports:\n      sast: bandit.json\n```\n\n## Best Practices\n\n1. **Run early and often** - Pre-commit hooks and CI/CD\n2. **Combine multiple tools** - Different tools catch different vulnerabilities\n3. **Tune false positives** - Configure exclusions and thresholds\n4. **Prioritize findings** - Focus on CRITICAL/HIGH first\n5. **Framework-aware scanning** - Use specific rulesets\n6. **Custom rules** - Organization-specific patterns\n7. **Developer training** - Secure coding practices\n8. **Incremental remediation** - Fix gradually\n9. **Baseline management** - Track known issues\n10. **Regular updates** - Keep tools current\n\n## Related Tools\n\n- **security-secrets.md** - Advanced credential detection\n- **security-owasp.md** - OWASP Top 10 assessment\n- **security-api.md** - API security testing\n- **security-scan.md** - Comprehensive security scanning\n\n## Limitations\n- Use this skill only when the task clearly matches the scope described above.\n- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.\n- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.","tags":["security","scanning","sast","antigravity","awesome","skills","sickn33","agent-skills","agentic-skills","ai-agent-skills","ai-agents","ai-coding"],"capabilities":["skill","source-sickn33","skill-security-scanning-security-sast","topic-agent-skills","topic-agentic-skills","topic-ai-agent-skills","topic-ai-agents","topic-ai-coding","topic-ai-workflows","topic-antigravity","topic-antigravity-skills","topic-claude-code","topic-claude-code-skills","topic-codex-cli","topic-codex-skills"],"categories":["antigravity-awesome-skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/sickn33/antigravity-awesome-skills/security-scanning-security-sast","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add sickn33/antigravity-awesome-skills","source_repo":"https://github.com/sickn33/antigravity-awesome-skills","install_from":"skills.sh"}},"qualityScore":"0.700","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 34583 github stars · SKILL.md body (14,473 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-04-22T18:52:12.734Z","embedding":null,"createdAt":"2026-04-18T21:44:08.344Z","updatedAt":"2026-04-22T18:52:12.734Z","lastSeenAt":"2026-04-22T18:52:12.734Z","tsv":"'-100':1274 '-79':425 '-89':400 '/.tox':271 '/build':272 '/no-secrets':342 '/tests':269 '/var/www/uploads':672 '/venv':270 '0':1181,1226,1228,1230,1232,1242,1273 '1':181,1243,1283,1413 '10':143,1277,1480,1495 '100':901,1296,1300 '1000':899 '15':897 '16':782 '2':190,1424 '2021':403 '3':200,1433 '3.11':1333,1387 '300':1138 '32':787 '4':210,751,1281,1441 '5':1448 '50':1299 '6':1456 '60':898 '7':1279,1463 '8':1469 '9':1474 'a03':402 'access':165,442,446 'across':27 'action':1304 'actions/checkout':1324 'actions/setup-python':1327 'actions/upload-artifact':1369 'advanc':137,1489 'akia':434 'allow':670,680,693 'analysi':75,105 'api':637,648,651,1498 'app':858,863 'app.secret':851 'app.use':888,890,894 'append':1056,1069,1087 'applic':7,18,1033 'approv':228 'arg':755 'array':754 'artifact':1407 'ask':1538 'assess':124,1496 'assign':416 'author':86 'auto':234,354,369,619,978,1118,1360,1402 'auto-detect':977 'auto-escap':618 'auto-fix':233 'avoid':220 'aw':429,441,445,451 'awar':1451 'b101':291 'b201':274 'b301':275 'b302':276 'b303':277 'b304':278 'b305':279 'b307':280 'b308':281 'b312':282 'b323':283 'b324':284 'b501':285 'b502':286 'b506':287 'b602':288 'b608':289 'bandit':48,243,249,250,256,265,1063,1070,1340,1351,1391,1393 'bandit-report.json':255 'bandit.json':1356,1377,1398,1410 'baselin':1475 'bash':244,295,348 'best':1411 'block':237 'boot':81 'boundari':1546 'brakeman':56,543 'branch':1312 'break':1020 'breakdown':1250 'build':170 'c':750,1288,1291 'calcul':1261 'cannot':164 'capabl':34 'captur':1132 'cargo':59,555 'cargo-clippi':58 'cargo.toml':1003 'catch':1430 'categori':937,1160 'check':541,1164 'ci':204,367,370,1380 'ci/cd':1301,1423 'clarif':1540 'class':931,955 'clear':1513 'clippi':60,556,558 'cmd':504,507,514 'code':12,24,102,123,168,223,643,1467 'codebas':199 'codeql':53 'combin':1425 'command':496,526,734 'command-inject':495 'commit':1420 'complianc':126 'comprehens':23,1025,1502 'confid':953,1196,1202 'config':353,359,363,368,728,1125,1359,1401 'configur':195,264,317,1437 'const':877,881 'content':707 'cooki':822,826 'cor':840,862,870,891 'count':1224,1238,1252,1259,1266 'credenti':138,430,452,1490 'criteria':1549 'critic':773,1225,1276 'critical/high':1446 'cross':593 'cross-sit':592 'csrf':71,792,825 'current':1485 'cursor.execute':384,578 'custom':84,114,372,1457 'cwe':398,399,423,424,949,1182,1188 'danger':407 'dangerous-innerhtml':406 'data':716,721,1141 'data.get':1147 'dataclass':923,925,930 'datetim':927,929 'datetime.now':1042 'db':655 'debug':794,805,835 'def':957,971,1023,1108,1214,1260 'deni':832 'deploy':120 'describ':1517 'descript':941,1166 'deseri':73,710 'detect':26,453,972,979,1491 'dev':300 'develop':89,1464 'dict':919,1028,1218,1267 'differ':1428,1431 'dir':268,475,671,681,694 'direct':598 'django':76,790,810 'django.middleware.clickjacking.xframeoptionsmiddleware':816 'django.middleware.csrf.csrfviewmiddleware':815 'django.middleware.security.securitymiddleware':814 'document.write':607 'dompurifi':627,629 'dompurify.sanitize':631 'dss':130 'e':1207,1213 'earli':1415 'either':501,518 'elem.innerhtml':410 'element.innerhtml':630 'element.textcontent':615 'enabl':232 'endpoint':148 'enforc':117 'environ':173,1529 'environment-specif':1528 'error':332,334,336,338,343,394,418,455,491,532 'escap':620 'eslint':50,293,301,304,308,323,1080,1089,1345 'eslint-plugin-no-secret':303,322 'eslint-secur':1088 'eslint-security.json':316 'eslint/plugin-security':302,321,1346 'eslintrc-security.json':318 'example.com':865,893 'except':1204,1205 'exclud':267 'exclus':1438 'execut':1031,1047,1055,1068,1086 'exempt':793 'expert':1534 'express':79,885 'express-rate-limit':884 'express.js':866 'ext':309 'extend':327 'extern':225 'extra':1155,1168,1184,1191,1198 'f':252,260,523,546,706,1016,1095,1097,1145,1209,1234,1353,1395 'f.get':1154,1163,1167,1173,1177,1183,1190,1197 'f.read':708 'f.severity':1239,1241 'fail':1212 'fals':806,1435 'file':661,673,676,677,682,684,687,698,702,943,1171 'file_path.startswith':691 'find':212,1048,1093,1246,1443 'first':1447 'fix':218,235,1472 'flask':77,833,847,854 'fmt':550 'focus':1444 'forbid':174 'forc':859 'format':314,381,392 'formatting/concatenation':567 'frame':830 'framework':30,74,111,185,788,1450 'framework-awar':1449 'framework-specif':110 'g':1344 'gemfil':997 'generat':1215,1221 'get':1156,1169,1179,1185,1187,1192,1194,1199,1201 'github':1303 'gitlab':1379 'go':44,548,998,999 'go.mod':1000 'gosec':57,549 'gosec.json':553 'gradual':1473 'hardcod':66,108,428,450,633,636 'hardcoded-aws-credenti':427 'helmet':869,878,880,889 'hex':781 'high':1227,1278 'high/critical':262 'hook':1421 'html':599,624 'https':860 'id':377,405,426,444,448,460,494,583,586,588,590,784,1165 'identifi':182 'idor':70 'ii':259 'imag':1385 'implement':906 'import':626,646,668,719,726,756,777,844,849,908,910,914,918,924,928 'increment':1470 'indic':982 'indicators.items':1008 'init':958 'inject':64,106,380,389,404,497,527,564,735 'innerhtml':408,415,605 'input':489,570,604,665,724,732,745,753,759,762,763,1543 'insecur':72,709,765 'instal':245,248,297,350,1335,1339,1343,1390 'instruct':180 'int':948,1269,1270,1297 'integr':47,1302 'invalid':697 'isoformat':1043 'issu':1479 'java':41,459,538,992,993 'javascript':420,458,609,876,986,1072 'javascript/typescript':40,292 'job':1314 'js':310,987 'json':253,261,315,319,355,361,365,547,551,720,909,1127,1354,1361,1396,1403 'json.loads':722,1142 'jsx':311 'keep':1483 'key':433,439,443,447,638,649,652,798,808,812,839,852,856 'known':1478 'lang':1005,1019 'languag':29,37,184,346,395,419,456,492,533,536,904,973,980,981,1022,1036,1038,1044,1045,1061,1074,1078 'languages.append':1018 'laravel':83 'latest':1321 'legaci':122 'len':1247 'limit':874,887,1505 'line':946,1175,1180 'list':920,969,975,1014 'll':258 'load':730 'local':206 'low':1231,1282 'main':1313 'manag':1476 'manipul':600 'map':144 'match':1514 'max':900 'medium':1158,1203,1229,1280 'messag':387,412,449,484,525,1170 'metadata':397,422,1186,1193,1200 'metavari':436,438,477,479,511,513 'metavariable-pattern':476,510 'metavariable-regex':435 'middlewar':801,813 'min':1295 'miss':799,868,1551 'mode':371 'modul':769 'multi':36,345,903 'multi-languag':35,344,902 'multilanguagesastscann':956 'multipl':28,1426 'mvn':539 'name':674,683,1306,1334,1347,1365,1372 'need':157 'no-secret':339 'npm':296,1342 'number':947,1176 'o':254,544,1355,1397 'often':1417 'open':464,467,472,660,701 'oper':774 'option':831 'organ':92,1460 'organization-specif':91,1459 'origin':864,892 'orm':591 'os':647,669,845 'os.environ.get':650,809,853 'os.getenv':654 'os.path.join':473,679 'os.path.realpath':686,692 'os.system':503,737 'outerhtml':606 'output':171,356,1133,1362,1404,1523 'owasp':127,401,951,1189,1195,1493 'p/owasp-top-ten':364,1120 'p/security-audit':360,1119 'package.json':988 'parameter':576 'parti':177 'password':639,653,656 'path':68,462,468,480,485,657,678,685,688,699,703,915,944,961,964,965,967,1131,1172,1174,1376 'path-traversal-open':461 'pathlib':913 'pattern':33,62,88,113,383,409,431,432,465,466,470,478,481,482,498,500,502,505,512,515,517,519,522,562,1006,1010,1012,1017,1462 'pattern-eith':499,516 'pattern-not':469 'pci':129 'pci-dss':128 'penetr':161 'permiss':1544 'php':43 'pickle.loads':712 'ping':749 'pip':247,349,1338,1389 'plain':613 'plugin':16,305,320,324,328 'pmd':54 'polici':95,116 'pom.xml':994 'posit':1436 'practic':1412,1468 'pre':119,1419 'pre-commit':1418 'pre-deploy':118 'print':1208 'priorit':213,1442 'project':960,966 'propos':217 'proprietari':222 'pull':1310 'py':984 'python':39,242,396,457,493,534,575,645,667,718,747,776,803,843,907,983,1059,1331,1386 'python-vers':1330 'queri':573,577 'quiet':1128 'r':251,257,704,1352,1394 'rail':82 'rais':695 'random':766,768 'rate':873,886 'ratelimit':882,895 'rb':996 'react':78,617 'redirect':819 'regex':437,440 'regular':1481 'relat':1486 'releas':238 'remedi':1471 'report':1367,1375,1408 'report.json':545 'reproduc':208 'req.get':483 'request':1311 'request.args.get':675 'requir':229,625,879,883,1542 'requirements.txt':985 'rest/graphql':147 'result':1040,1053,1066,1084,1092,1101,1107,1122,1148 'result.stdout':1140,1143 'return':1021,1105,1244,1294 'review':103,230,1535 'risk':1253,1256,1262,1271 'rs':1002 'rubi':42,542,995 'rule':85,196,330,373,376,1458 'ruleset':1116,1126,1211,1455 'run':201,1024,1109,1113,1317,1337,1348,1350,1414 'runs-on':1316 'runtim':158 'rust':45,554,1001 'safe':474,758 'safeti':219,1545 'sanit':622 'sast':5,10,14,21,38,192,239,1026,1034,1161,1307,1315,1374,1382,1409 'sast-report':1373 'sastfind':932,970,1150 'save':299 'save-dev':298 'scan':3,139,178,189,202,246,1039,1051,1052,1064,1065,1082,1083,1091,1100,1106,1111,1308,1349,1452,1504 'scanner':905 'scope':187,1516 'score':1254,1257,1263,1272 'script':595,1388 'secret':67,109,307,326,341,634,778,797,807,811,838,855 'secrets.token':780,785 'secur':2,4,8,15,19,32,51,94,104,115,294,574,608,644,666,717,725,733,746,772,775,789,800,802,817,823,827,842,875,1081,1090,1466,1499,1503 'security-api.md':145,1497 'security-crit':771 'security-owasp.md':140,1492 'security-scan.md':1501 'security-scanning-security-sast':1 'security-secrets.md':135,1488 'security/detect-eval-with-expression':335 'security/detect-non-literal-fs-filename':333 'security/detect-object-injection':331 'security/detect-pseudo-random-prng':337 'security/recommended':329 'select':191,241,579 'self':959,974,1027,1112,1217,1264 'self.calculate':1255 'self.detect':1037 'self.findings':968,1099,1236,1248 'self.findings.append':1149 'self.generate':1103 'self.project':963,1130 'self.project_path.glob':1015 'self.run':1049,1062,1079 'semgrep':49,87,347,351,352,358,362,366,1050,1057,1110,1114,1124,1152,1210,1341,1358,1392,1400 'semgrep-report.json':357 'semgrep.json':1363,1378,1405 'semgrep.yml':374 'servic':226 'session':783,821 'set':209 'settings.py':804 'sever':215,393,417,454,490,531,935,1153,1157,1223,1237,1249,1251,1258,1265 'severity_counts.get':1240 'severity_counts.items':1293 'shell':508,529,741 'shlex':757 'shlex.quote':760 'site':594 'skill':98,153,1508 'skill-security-scanning-security-sast' 'skip':290 'soc2':131 'sonarqub':52 'sourc':167,642 'source-sickn33' 'special':132 'specif':93,112,1454,1461,1530 'spotbug':55,540 'spring':80 'sql':63,379,388,563,572 'sql-injection-format-str':378 'ssl':818 'stage':1383 'start':1178 'static':6,17 'statist':1222 'step':1322 'stop':1536 'str':934,936,938,940,942,945,950,952,954,962,976,1029,1129,1219,1268 'string':382,391,566 'subprocess':739,911 'subprocess.call':506 'subprocess.run':748,1123 'substitut':1526 'success':1548 'sum':1285 'summari':1102,1104,1216 'talisman':848,850,857 'task':1512 'test':9,20,159,162,273,1384,1500,1532 'text':614,1135 'textcont':611 'third':176 'third-parti':175 'threshold':1440 'timeout':1137 'timestamp':1041 'titl':939,1162 'token':640,779 'tool':46,133,179,193,240,537,933,1035,1046,1054,1067,1085,1151,1336,1427,1429,1484,1487 'top':142,1494 'topic-agent-skills' 'topic-agentic-skills' 'topic-ai-agent-skills' 'topic-ai-agents' 'topic-ai-coding' 'topic-ai-workflows' 'topic-antigravity' 'topic-antigravity-skills' 'topic-claude-code' 'topic-claude-code-skills' 'topic-codex-cli' 'topic-codex-skills' 'total':1245,1284,1298 'track':1477 'train':1465 'travers':69,463,486,658 'treat':1521 'tri':1121 'triag':211 'true':509,530,742,795,820,824,828,836,861,1134,1136,1357,1364,1399,1406 'ts':312,990 'tsconfig.json':991 'tsx':313 'tune':1434 'type':917 'typescript':421,989,1076 'ubuntu':1320 'ubuntu-latest':1319 'unsanit':602,663 'untrust':715 'unwrap':559 'updat':1482 'upload':221,1366 'upper':1159 'urlsaf':786 'use':96,100,134,151,560,610,662,1323,1326,1368,1453,1506 'user':488,569,581,585,589,603,664,723,731,744,752,761 'user.objects.filter':587 'userinput':616,621,632 'v3':1325,1370 'v4':1328 'valid':121,764,1531 'valueerror':696 'var':386,411,524,1094 'version':1332 'via':390,414,487,528 'vulner':13,25,61,107,561,565,597,635,659,711,736,767,791,834,867,1432 'w':557 'weak':796,837 'weight':1275,1286 'wildcard':841,871 'windowm':896 'without':227 'x':520,829 'xss':65,413,596 'y':521 'yaml':266,375,727,1305,1381 'yaml.load':713 'yaml.safe':729","prices":[{"id":"6406517c-4e78-4d6e-bcbf-86bc405325fc","listingId":"57291c91-cd70-4be2-9ebf-1ffb25422179","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"sickn33","category":"antigravity-awesome-skills","install_from":"skills.sh"},"createdAt":"2026-04-18T21:44:08.344Z"}],"sources":[{"listingId":"57291c91-cd70-4be2-9ebf-1ffb25422179","source":"github","sourceId":"sickn33/antigravity-awesome-skills/security-scanning-security-sast","sourceUrl":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security-scanning-security-sast","isPrimary":false,"firstSeenAt":"2026-04-18T21:44:08.344Z","lastSeenAt":"2026-04-22T18:52:12.734Z"}],"details":{"listingId":"57291c91-cd70-4be2-9ebf-1ffb25422179","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"sickn33","slug":"security-scanning-security-sast","github":{"repo":"sickn33/antigravity-awesome-skills","stars":34583,"topics":["agent-skills","agentic-skills","ai-agent-skills","ai-agents","ai-coding","ai-workflows","antigravity","antigravity-skills","claude-code","claude-code-skills","codex-cli","codex-skills","cursor","cursor-skills","developer-tools","gemini-cli","gemini-skills","kiro","mcp","skill-library"],"license":"mit","html_url":"https://github.com/sickn33/antigravity-awesome-skills","pushed_at":"2026-04-22T06:40:00Z","description":"Installable GitHub library of 1,400+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.","skill_md_sha":"1fcd85dbd63df11b4c3dcbaad2919c7a80894243","skill_md_path":"skills/security-scanning-security-sast/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security-scanning-security-sast"},"layout":"multi","source":"github","category":"antigravity-awesome-skills","frontmatter":{"name":"security-scanning-security-sast","description":"'Static Application Security Testing (SAST) for code vulnerability"},"skills_sh_url":"https://skills.sh/sickn33/antigravity-awesome-skills/security-scanning-security-sast"},"updatedAt":"2026-04-22T18:52:12.734Z"}}