Sast Configuration

Name: Sast Configuration
Author: Dokhacgiakhoa

ASecurity

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

508 stars

0 votes

0 copies

4 views

Added 9/7/2026

developmenttestingci/cdsecurityperformance

Security Analysis

A100/100

Pro scans all 14 files and shows the line behind each finding

Scanned 9/7/2026

$npx -y skills add Dokhacgiakhoa/antigravity-ide --skill sast-configuration --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Sast Configuration?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Sast Configuration

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/dokhacgiakhoa-sast-configuration/badge)](https://www.skillsdirectory.com/skills/dokhacgiakhoa-sast-configuration)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

Files

SKILL.md

---
version: 4.1.0-fractal
name: sast-configuration
description: Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
---

# SAST Configuration

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

## Use this skill when

- Set up SAST scanning in CI/CD pipelines
- Create custom security rules for your codebase
- Configure quality gates and compliance policies
- Optimize scan performance and reduce false positives
- Integrate multiple SAST tools for defense-in-depth

## Do not use this skill when

- You only need DAST or manual penetration testing guidance
- You cannot access source code or CI/CD pipelines
- You need organizational policy decisions rather than tooling setup

## Instructions

1. Identify languages, repos, and compliance requirements.
2. Choose tools and define a baseline policy.
3. Integrate scans into CI/CD with gating thresholds.
4. Tune rules and suppressions based on false positives.
5. Track remediation and verify fixes.

## Safety

- Avoid scanning sensitive repos with third-party services without approval.
- Prevent leaks of secrets in scan artifacts and logs.

## Overview

This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.

## Core Capabilities

## 🧠 Knowledge Modules (Fractal Skills)

### 1. [1. Semgrep Configuration](./sub-skills/1-semgrep-configuration.md)
### 2. [2. SonarQube Setup](./sub-skills/2-sonarqube-setup.md)
### 3. [3. CodeQL Analysis](./sub-skills/3-codeql-analysis.md)
### 4. [Initial Assessment](./sub-skills/initial-assessment.md)
### 5. [Basic Setup](./sub-skills/basic-setup.md)
### 6. [CI/CD Pipeline Integration](./sub-skills/cicd-pipeline-integration.md)
### 7. [Pre-commit Hook](./sub-skills/pre-commit-hook.md)
### 8. [New Project Setup](./sub-skills/new-project-setup.md)
### 9. [Custom Rule Development](./sub-skills/custom-rule-development.md)
### 10. [Compliance Scanning](./sub-skills/compliance-scanning.md)
### 11. [High False Positive Rate](./sub-skills/high-false-positive-rate.md)
### 12. [Performance Issues](./sub-skills/performance-issues.md)
### 13. [Integration Failures](./sub-skills/integration-failures.md)

Attribution

Dokhacgiakhoa

View source See grades on GitHub More from Dokhacgiakhoa →

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

--- version: 4.1.0-fractal name: sast-configuration description: Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection. --- # SAST Configuration Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages. ## Use this skill when - Set up SAST scanning in CI/CD pipelines - Create custom security rules for your codebase - Configure quality gates and compliance policies - Optimize scan performance and reduce false positives - Integrate multiple SAST tools for defense-in-depth ## Do not use this skill when - You only need DAST or manual penetration testing guidance - You cannot access source code or CI/CD pipelines - You need organizational policy decisions rather than tooling setup ## Instructions 1. Identify languages, repos, and compliance requirements. 2. Choose tools and define a baseline policy. 3. Integrate scans into CI/CD with gating thresholds. 4. Tune rules and suppressions based on false positives. 5. Track remediation and verify fixes. ## Safety - Avoid scanning sensitive repos with third-party services without approval. - Prevent leaks of secrets in scan artifacts and logs. ## Overview This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. ## Core Capabilities ## 🧠 Knowledge Modules (Fractal Skills) ### 1. [1. Semgrep Configuration](./sub-skills/1-semgrep-configuration.md) ### 2. [2. SonarQube Setup](./sub-skills/2-sonarqube-setup.md) ### 3. [3. CodeQL Analysis](./sub-skills/3-codeql-analysis.md) ### 4. [Initial Assessment](./sub-skills/initial-assessment.md) ### 5. [Basic Setup](./sub-skills/basic-setup.md) ### 6. [CI/CD Pipeline Integration](./sub-skills/cicd-pipeline-integration.md) ### 7. [Pre-commit Hook](./sub-skills/pre-commit-hook.md) ### 8. [New Project Setup](./sub-skills/new-project-setup.md) ### 9. [Custom Rule Development](./sub-skills/custom-rule-development.md) ### 10. [Compliance Scanning](./sub-skills/compliance-scanning.md) ### 11. [High False Positive Rate](./sub-skills/high-false-positive-rate.md) ### 12. [Performance Issues](./sub-skills/performance-issues.md) ### 13. [Integration Failures](./sub-skills/integration-failures.md)