Maintainer of this skill?
Automated security scan — not a certification.
by utkusen
Collection of agent skills to find vulnerabilities inside your web/mobile apps.
# Add to your Claude Code skills
git clone https://github.com/utkusen/sast-skillsGuides for using ai agents skills like sast-skills.
Last scanned: 5/10/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-05-10T06:36:11.111Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}See how sast-skills compares with popular alternatives.
sast-skills is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by utkusen. Collection of agent skills to find vulnerabilities inside your web/mobile apps. It has 1,373 GitHub stars.
Yes. sast-skills passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/utkusen/sast-skills" and add it to your Claude Code skills directory (see the Installation section above).
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh sast-skills against similar tools.
No comments yet. Be the first to share your thoughts!
From $49 · 30 days · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
A collection of agent skills that turn your LLM coding assistant into a fully functional SAST scanner to find vulnerabilities in your codebase. Works natively with Claude Code, Codex, Opencode, Cursor and any other assistant that supports agent skills. No third-party tools required.
The main goal of this project is to find as many vulnerabilities as possible at the lowest possible cost.
CLAUDE.md (for Claude Code) or AGENTS.md (for Opencode and other IDEs) orchestrates the entire assessment workflow automatically. The assessment runs in three steps:
Codebase Analysis -- The sast-analysis skill maps the technology stack, architecture, entry points, data flows, and trust boundaries. It writes its findings to sast/architecture.md.
Vulnerability Detection (parallel) -- All 13 vulnerability detection skills run in parallel as subagents. Each skill follows a two-phase approach: first a recon/discovery phase to find candidate sections, then a verification phase to confirm exploitability. Results are written to sast/*-results.md.
Report Generation -- The sast-report skill consolidates all findings into a single sast/final-report.md, ranked by severity with full remediation guidance and dynamic test instructions.
| Skill | Vulnerability Class |
|---|---|
| sast-analysis | Codebase reconnaissance, architecture mapping, threat modeling |
| sast-sqli | SQL Injection |
| sast-graphql | GraphQL injection |
| sast-xss | Cross-Site Scripting (XSS) |
| sast-rce | Remote Code Execution (command injection, eval, unsafe deserialization) |
| sast-ssrf | Server-Side Request Forgery |
| sast-idor | Insecure Direct Object Reference |
| sast-xxe | XML External Entity |
| sast-ssti | Server-Side Template Injection |
| sast-jwt | Insecure JWT implementations |
| sast-missingauth | Missing authentication and broken function-level authorization |
| sast-pathtraversal | Path / directory traversal |
| sast-fileupload | Insecure file upload |
| sast-businesslogic | Business logic flaws (price manipulation, workflow bypass, race conditions, etc.) |
| sast-report | Consolidated final report ranked by severity |
Copy your project into the sast-files folder, then open sast-files as your workspace in your AI coding assistant.
cp -r /path/to/your/project sast-files/
Note: If your project already contains a
CLAUDE.mdorAGENTS.mdfile, remove it before running the assessment — otherwise it will conflict with the orchestration file provided by this toolkit.
After copying the files, open your project in your AI coding assistant and ask:
Run vulnerability scan
or
Find vulnerabilities in this codebase
The entry point file (CLAUDE.md or AGENTS.md) orchestrates the full workflow automatically. It will skip any steps whose output files already exist, so you can safely re-run it after fixing issues.
All output is written to a sast/ folder in your project root:
| File | Description |
|---|---|
sast/architecture.md |
Technology stack, architecture, entry points, data flows |
sast/*-results.md |
Per-vulnerability-class findings with proof and remediation |
sast/final-report.md |
Consolidated report ranked by severity |