# Scanit

> Packages and runs a local SAST pipeline scan to identify source code vulnerabilities. - User asks to scan the codebase, run a scan, or check for vulnerabilities - User mentions "scanit", "pipeline scan", "SAST scan", "scan my code" - User wants to know if their code has security issues before committing or deploying

- Skill: `aibot88/scanit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/scanit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/scanit/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/scanit

---


# SAST Pipeline Scanner

Packages the workspace and runs a Veracode pipeline SAST scan to identify source code vulnerabilities.

**Scope**: This skill covers static analysis (SAST) only. For third-party dependency and IaC scanning, use the `thirdit` skill instead.

## Step 1 — Package the workspace

Package the workspace source code into a scan artifact. The packager auto-detects languages and build systems. If packaging fails, read the error — the most common causes are a missing build output directory or an unsupported project structure, both of which have actionable error messages.

## Step 2 — Run the scan

Run the pipeline scan in **synchronous mode** so the user receives results in the same session without needing to poll or return later. If packaging fails, read the error before retrying — the most common causes are a missing build output or an unsupported project structure.

## Step 3 — Retrieve results

Once the scan completes, retrieve findings immediately. If no findings are returned, confirm the scan completed cleanly and the application passes policy.

If the scan fails (not packaging — the scan itself), report the error message directly. Do not retry automatically.

## Constraints

- Do NOT run a local SCA scan — that is the `thirdit` skill's responsibility.
- Do NOT package and scan if the user only asked to check existing results — use the `reportit` skill for that.
- Do NOT suggest retrying a failed package step by modifying scan parameters — diagnose the actual packaging error first.