How do I install the Sast Lite skill?

Run npx skillmds@latest add novacode37/sast-lite in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sast Lite safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sast Lite?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sast Lite free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Sast Lite?

NovaCode37 (@novacode37) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sast Lite by novacode37 — Agent Skill

Name: Sast Lite
Author: NovaCode37

Sast Lite

Static security analysis for Python source via AST walking — finds command injection, insecure deserialization, eval/exec, weak crypto, SQL injection, disabled TLS verification, hardcoded secrets and more, each tagged with a CWE. Use when the user asks to "audit this code for vulnerabilities", "run a SAST scan", "security review this Python file", or before merging untrusted code.

NovaCode37 e2767d9 3 files · 18.5 KB Updated Sep 17, 2026

File contents

SAST Lite

An AST-based static analyzer for Python. Instead of fragile regex matching, it parses each file into an abstract syntax tree and inspects how dangerous APIs are actually called — so subprocess.run(cmd, shell=True) is flagged while subprocess.run(["ls"]) is not. No third-party dependencies.

When to use this skill

"Audit / security-review this Python code."
"Run a SAST scan on the project."
Reviewing a PR or untrusted snippet before running it.
A pre-merge CI gate for security regressions.

What it detects

Rule	CWE	Severity
`eval()` / `exec()` on dynamic input	CWE-95	critical/high
`os.system` / `subprocess(shell=True)`	CWE-78	high
`pickle`/`marshal` deserialization	CWE-502	high
`yaml.load` without SafeLoader	CWE-20	high
SQL via f-string / concat / `.format` / `%`	CWE-89	high
`requests(verify=False)`	CWE-295	high
Hardcoded password/secret literal	CWE-798	high
Weak hash (md5/sha1)	CWE-327	medium
`tempfile.mktemp`	CWE-377	medium
`Flask(debug=True)`	CWE-489	medium
Jinja2 `autoescape=False`	CWE-79	medium
`assert` used for a security check	CWE-617	medium

How to run it

# Scan a directory
python skills/sast-lite/analyzer.py src/

# JSON for tooling / CI
python skills/sast-lite/analyzer.py . --json

# Only show high+ severity
python skills/sast-lite/analyzer.py . --min-severity high

Exit codes: 0 clean · 1 issues found · 2 usage/parse error — ready for CI gating.

Recommended workflow for Claude

Run with --json and parse the issue list.
For each issue, open path:line and confirm the data flow is genuinely attacker-controllable (the analyzer is intra-procedural, so it may flag patterns that are safe in context).
Propose a concrete fix per finding — e.g. parameterized queries for py.sql-injection, yaml.safe_load for py.yaml-load, list-form subprocess calls for py.subprocess-shell.
Summarize by severity and CWE.

Limitations

This is a lite analyzer: single-file, no cross-function taint tracking. It is designed for fast, high-signal triage — not a replacement for a full SAST suite. Treat findings as leads to verify, not automatic verdicts.

---name: sast-litedescription: Static security analysis for Python source via AST walking — finds command injection, insecure deserialization, eval/exec, weak crypto, SQL injection, disabled TLS verification, hardcoded secrets and more, each tagged with a CWE. Use when the user asks to "audit this code for vulnerabilities", "run a SAST scan", "security review this Python file", or before merging untrusted code.license: MIT---# SAST LiteAn AST-based static analyzer for Python. Instead of fragile regex matching, itparses each file into an abstract syntax tree and inspects how dangerous APIsare actually called — so `subprocess.run(cmd, shell=True)` is flagged while`subprocess.run(["ls"])` is not. **No third-party dependencies.**## When to use this skill- "Audit / security-review this Python code."- "Run a SAST scan on the project."- Reviewing a PR or untrusted snippet before running it.- A pre-merge CI gate for security regressions.## What it detects| Rule | CWE | Severity ||------|-----|----------|| `eval()` / `exec()` on dynamic input | CWE-95 | critical/high || `os.system` / `subprocess(shell=True)` | CWE-78 | high || `pickle`/`marshal` deserialization | CWE-502 | high || `yaml.load` without SafeLoader | CWE-20 | high || SQL via f-string / concat / `.format` / `%` | CWE-89 | high || `requests(verify=False)` | CWE-295 | high || Hardcoded password/secret literal | CWE-798 | high || Weak hash (md5/sha1) | CWE-327 | medium || `tempfile.mktemp` | CWE-377 | medium || `Flask(debug=True)` | CWE-489 | medium || Jinja2 `autoescape=False` | CWE-79 | medium || `assert` used for a security check | CWE-617 | medium |## How to run it```bash# Scan a directorypython skills/sast-lite/analyzer.py src/# JSON for tooling / CIpython skills/sast-lite/analyzer.py . --json# Only show high+ severitypython skills/sast-lite/analyzer.py . --min-severity high```**Exit codes:** `0` clean · `1` issues found · `2` usage/parse error — readyfor CI gating.## Recommended workflow for Claude1. Run with `--json` and parse the issue list.2. For each issue, open `path:line` and confirm the data flow is genuinely attacker-controllable (the analyzer is intra-procedural, so it may flag patterns that are safe in context).3. Propose a concrete fix per finding — e.g. parameterized queries for `py.sql-injection`, `yaml.safe_load` for `py.yaml-load`, list-form `subprocess` calls for `py.subprocess-shell`.4. Summarize by severity and CWE.## LimitationsThis is a *lite* analyzer: single-file, no cross-function taint tracking. It isdesigned for fast, high-signal triage — not a replacement for a full SASTsuite. Treat findings as leads to verify, not automatic verdicts.

Frequently asked questions