Scanit

SAST Pipeline Scanner

Packages the workspace and runs a Veracode pipeline SAST scan to identify source code vulnerabilities.

Scope: This skill covers static analysis (SAST) only. For third-party dependency and IaC scanning, use the thirdit skill instead.

Step 1 — Package the workspace

Package the workspace source code into a scan artifact. The packager auto-detects languages and build systems. If packaging fails, read the error — the most common causes are a missing build output directory or an unsupported project structure, both of which have actionable error messages.

Step 2 — Run the scan

Run the pipeline scan in synchronous mode so the user receives results in the same session without needing to poll or return later. If packaging fails, read the error before retrying — the most common causes are a missing build output or an unsupported project structure.

Step 3 — Retrieve results

Once the scan completes, retrieve findings immediately. If no findings are returned, confirm the scan completed cleanly and the application passes policy.

If the scan fails (not packaging — the scan itself), report the error message directly. Do not retry automatically.

Constraints

• Do NOT run a local SCA scan — that is the thirdit skill's responsibility.
• Do NOT package and scan if the user only asked to check existing results — use the reportit skill for that.
• Do NOT suggest retrying a failed package step by modifying scan parameters — diagnose the actual packaging error first.