How do I install the Sast Configuration skill?

Run npx skillmds@latest add dokhacgiakhoa/sast-configuration in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sast Configuration safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sast Configuration?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sast Configuration free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sast Configuration?

Dokhacgiakhoa (@dokhacgiakhoa) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sast Configuration by dokhacgiakhoa

Name: Sast Configuration
Rating: 4.2 (5 reviews)
Author: Dokhacgiakhoa

Sast Configuration

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Dokhacgiakhoa Updated Sep 9, 2026 505 repo stars

File contents

SAST Configuration

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

Use this skill when

Set up SAST scanning in CI/CD pipelines
Create custom security rules for your codebase
Configure quality gates and compliance policies
Optimize scan performance and reduce false positives
Integrate multiple SAST tools for defense-in-depth

Do not use this skill when

You only need DAST or manual penetration testing guidance
You cannot access source code or CI/CD pipelines
You need organizational policy decisions rather than tooling setup

Instructions

Identify languages, repos, and compliance requirements.
Choose tools and define a baseline policy.
Integrate scans into CI/CD with gating thresholds.
Tune rules and suppressions based on false positives.
Track remediation and verify fixes.

Safety

Avoid scanning sensitive repos with third-party services without approval.
Prevent leaks of secrets in scan artifacts and logs.

Overview

This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.

Core Capabilities

🧠 Knowledge Modules (Fractal Skills)

1. 1. Semgrep Configuration

2. 2. SonarQube Setup

3. 3. CodeQL Analysis

4. Initial Assessment

5. Basic Setup

6. CI/CD Pipeline Integration

7. Pre-commit Hook

8. New Project Setup

9. Custom Rule Development

10. Compliance Scanning

11. High False Positive Rate

12. Performance Issues

13. Integration Failures

---name: sast-configurationdescription: Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.--- # SAST Configuration Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages. ## Use this skill when - Set up SAST scanning in CI/CD pipelines - Create custom security rules for your codebase - Configure quality gates and compliance policies - Optimize scan performance and reduce false positives - Integrate multiple SAST tools for defense-in-depth ## Do not use this skill when - You only need DAST or manual penetration testing guidance - You cannot access source code or CI/CD pipelines - You need organizational policy decisions rather than tooling setup ## Instructions 1. Identify languages, repos, and compliance requirements. 2. Choose tools and define a baseline policy. 3. Integrate scans into CI/CD with gating thresholds. 4. Tune rules and suppressions based on false positives. 5. Track remediation and verify fixes. ## Safety - Avoid scanning sensitive repos with third-party services without approval. - Prevent leaks of secrets in scan artifacts and logs. ## Overview This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. ## Core Capabilities ## 🧠 Knowledge Modules (Fractal Skills) ### 1. [1. Semgrep Configuration](./sub-skills/1-semgrep-configuration.md) ### 2. [2. SonarQube Setup](./sub-skills/2-sonarqube-setup.md) ### 3. [3. CodeQL Analysis](./sub-skills/3-codeql-analysis.md) ### 4. [Initial Assessment](./sub-skills/initial-assessment.md) ### 5. [Basic Setup](./sub-skills/basic-setup.md) ### 6. [CI/CD Pipeline Integration](./sub-skills/cicd-pipeline-integration.md) ### 7. [Pre-commit Hook](./sub-skills/pre-commit-hook.md) ### 8. [New Project Setup](./sub-skills/new-project-setup.md) ### 9. [Custom Rule Development](./sub-skills/custom-rule-development.md) ### 10. [Compliance Scanning](./sub-skills/compliance-scanning.md) ### 11. [High False Positive Rate](./sub-skills/high-false-positive-rate.md) ### 12. [Performance Issues](./sub-skills/performance-issues.md) ### 13. [Integration Failures](./sub-skills/integration-failures.md)

Frequently asked questions