# Security Sast Audit

> Perform static application security testing (SAST), secret scanning, dependency vulnerability audits (OWASP Top 10, bandit, semgrep, trivy, pip-audit, npm audit).

- Skill: `pedroiff0/security-sast-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add pedroiff0/security-sast-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/pedroiff0/security-sast-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: pedroiff0 (https://skillmd.com/u/pedroiff0)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/pedroiff0/security-sast-audit

---


# Static Application Security Testing (SAST) & Auditing

Audit codebases for exposed secrets, outdated dependencies with known CVEs, and insecure code patterns.

## When to Use

- Pre-commit security verification or PR review security audits.
- Scanning for hardcoded API keys, JWT tokens, and private certificates.
- Checking npm or pip dependency lockfiles against advisory databases.