How do I install the Sast Runner skill?

Run npx skillmds add majiayu000/sast-runner in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sast Runner safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sast Runner?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sast Runner free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sast Runner?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sast Runner by majiayu000 — Agent Skill

Name: Sast Runner
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

Sast Runner

Runs Static Application Security Testing (SAST) using Semgrep. Scans source code for vulnerabilities, security anti-patterns, and OWASP Top 10 issues. Use when user asks to "run SAST", "scan for vulnerabilities", "static analysis", "code security scan", "静的解析", "脆弱性スキャン".

majiayu000 4548904 2 files · 3.1 KB Updated Sep 9, 2026 567 repo stars

File contents

SAST Runner

Wrapper for Semgrep to perform Static Application Security Testing.

Prerequisites

Semgrep must be installed:

# pip
pip install semgrep

# macOS
brew install semgrep

# Docker
docker pull semgrep/semgrep

Usage

# Scan current directory with auto config
npx sast-runner .

# Scan with specific ruleset
npx sast-runner . --config security-audit

# Scan with JSON output
npx sast-runner . --json

# Available rulesets
npx sast-runner --list-configs

# Check if semgrep is installed
npx sast-runner --check

Rulesets

Config	Description
auto	Auto-detect languages and apply relevant rules
security-audit	Comprehensive security audit
owasp-top-ten	OWASP Top 10 focused
cwe-top-25	CWE/SANS Top 25
default	Default ruleset

Output Format

{
  "tool": "semgrep",
  "scanPath": ".",
  "findings": [
    {
      "id": "javascript.express.security.audit.xss.mustache-escape",
      "severity": "high",
      "message": "Potential XSS vulnerability",
      "file": "src/app.js",
      "line": 42,
      "code": "res.send(userInput)",
      "cwes": ["CWE-79"],
      "owasp": ["A03:2021"],
      "fix": "Use proper output encoding"
    }
  ],
  "summary": {
    "total": 1,
    "critical": 0,
    "high": 1,
    "medium": 0,
    "low": 0
  }
}

Exit Codes

0: No issues found
1: Issues detected
2: Tool not installed or error

CWE Coverage

Common vulnerabilities detected:

CWE-89: SQL Injection
CWE-79: Cross-site Scripting (XSS)
CWE-78: OS Command Injection
CWE-94: Code Injection
CWE-22: Path Traversal
CWE-502: Deserialization of Untrusted Data
CWE-200: Exposure of Sensitive Information

Supported Languages

JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, C, C++, Rust, Kotlin, Swift, and more.

---name: sast-runnerdescription: Runs Static Application Security Testing (SAST) using Semgrep. Scans source code for vulnerabilities, security anti-patterns, and OWASP Top 10 issues. Use when user asks to "run SAST", "scan for vulnerabilities", "static analysis", "code security scan", "静的解析", "脆弱性スキャン".--- # SAST Runner Wrapper for Semgrep to perform Static Application Security Testing. ## Prerequisites Semgrep must be installed: ```bash # pip pip install semgrep # macOS brew install semgrep # Docker docker pull semgrep/semgrep ``` ## Usage ```bash # Scan current directory with auto config npx sast-runner . # Scan with specific ruleset npx sast-runner . --config security-audit # Scan with JSON output npx sast-runner . --json # Available rulesets npx sast-runner --list-configs # Check if semgrep is installed npx sast-runner --check ``` ## Rulesets | Config | Description | |--------|-------------| | auto | Auto-detect languages and apply relevant rules | | security-audit | Comprehensive security audit | | owasp-top-ten | OWASP Top 10 focused | | cwe-top-25 | CWE/SANS Top 25 | | default | Default ruleset | ## Output Format ```json { "tool": "semgrep", "scanPath": ".", "findings": [ { "id": "javascript.express.security.audit.xss.mustache-escape", "severity": "high", "message": "Potential XSS vulnerability", "file": "src/app.js", "line": 42, "code": "res.send(userInput)", "cwes": ["CWE-79"], "owasp": ["A03:2021"], "fix": "Use proper output encoding" } ], "summary": { "total": 1, "critical": 0, "high": 1, "medium": 0, "low": 0 } } ``` ## Exit Codes - `0`: No issues found - `1`: Issues detected - `2`: Tool not installed or error ## CWE Coverage Common vulnerabilities detected: - CWE-89: SQL Injection - CWE-79: Cross-site Scripting (XSS) - CWE-78: OS Command Injection - CWE-94: Code Injection - CWE-22: Path Traversal - CWE-502: Deserialization of Untrusted Data - CWE-200: Exposure of Sensitive Information ## Supported Languages JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, C, C++, Rust, Kotlin, Swift, and more.

Frequently asked questions