{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/sast-configuration",
  "version": "1.0.0",
  "name": "Sast Configuration",
  "description": "Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or aut...",
  "system_prompt_fragment": "# SAST Configuration\n\nStatic Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.\n\n## Use this skill when\n\n- Set up SAST scanning in CI/CD pipelines\n- Create custom security rules for your codebase\n- Configure quality gates and compliance policies\n- Optimize scan performance and reduce false positives\n- Integrate multiple SAST tools for defense-in-depth\n\n## Do not use this skill when\n\n- You only need DAST or manual penetration testing guidance\n- You cannot access source code or CI/CD pipelines\n- You need organizational policy decisions rather than tooling setup\n\n## Instructions\n\n1. Identify languages, repos, and compliance requirements.\n2. Choose tools and define a baseline policy.\n3. Integrate scans into CI/CD with gating thresholds.\n4. Tune rules and suppressions based on false positives.\n5. Track remediation and verify fixes.\n\n## Safety\n\n- Avoid scanning sensitive repos with third-party services without approval.\n- Prevent leaks of secrets in scan artifacts and logs.\n\n## Overview\n\nThis skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.\n\n## Core Capabilities\n\n### 1. Semgrep Configuration\n- Custom rule creation with pattern matching\n- Language-specific security rules (Python, JavaScript, Go, Java, etc.)\n- CI/CD integration (GitHub Actions, GitLab CI, Jenkins)\n- False positive tuning and rule optimization\n- Organizational policy enforcement\n\n### 2. SonarQube Setup\n- Quality gate configuration\n- Security hotspot analysis\n- Code coverage and technical debt tracking\n- Custom quality profiles for languages\n- Enterprise integration with LDAP/SAML\n\n### 3. CodeQL Analysis\n- GitHub Advanced Security integration\n- Custom query development\n- Vulnerability variant analysis\n- Security research workflows\n- SARIF result processing\n\n## Quick Start\n\n### Initial Assessment\n1. Identify primary programming languages in your codebase\n2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)\n3. Choose SAST tool based on language support and integration needs\n4. Review baseline scan to understand current security posture\n\n### Basic Setup\n```bash\n# Semgrep quick start\npip install semgrep\nsemgrep --config=auto --error\n\n# SonarQube with Docker\ndocker run -d --name sonarqube -p 9000:9000 sonarqube:latest\n\n# CodeQL CLI setup\ngh extension install github/gh-codeql\ncodeql database create mydb --language=python\n```\n\n## Reference Documentation\n\n- Semgrep Rule Creation - Pattern-based security rule development\n- SonarQube Configuration - Quality gates and profiles\n- CodeQL Setup Guide - Query development and workflows\n\n## Templates & Assets\n\n- semgrep-config.yml - Production-ready Semgrep configuration\n- sonarqube-settings.xml - SonarQube quality profile template\n- run-sast.sh - Automated SAST execution script\n\n## Integration Patterns\n\n### CI/CD Pipeline Integration\n```yaml\n# GitHub Actions example\n- name: Run Semgrep\n  uses: returntocorp/semgrep-action@v1\n  with:\n    config: >-\n      p/security-audit\n      p/owasp-top-ten\n```\n\n### Pre-commit Hook\n```bash\n# .pre-commit-config.yaml\n- repo: https://github.com/returntocorp/semgrep\n  rev: v1.45.0\n  hooks:\n    - id: semgrep\n      args: ['--config=auto', '--error']\n```\n\n## Best Practices\n\n1. **Start with Baseline**\n   - Run initial scan to establish security baseline\n   - Prioritize critical and high severity findings\n   - Create remediation roadmap\n\n2. **Incremental Adoption**\n   - Begin with security-focused rules\n   - Gradually add code quality rules\n   - Implement blocking only for critical issues\n\n3. **False Positive Management**\n   - Document legitimate suppressions\n   - Create allow lists for known safe patterns\n   - Regularly review suppressed findings\n\n4. **Performance Optimization**\n   - Exclude test files and generated code\n   - Use incremental scanning for large codebases\n   - Cache scan results in CI/CD\n\n5. **Team Enablement**\n   - Provide security training for developers\n   - Create internal documentation for common patterns\n   - Establish security champions program\n\n## Common Use Cases\n\n### New Project Setup\n```bash\n./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube\n```\n\n### Custom Rule Development\n```yaml\n# See references/semgrep-rules.md for detailed examples\nrules:\n  - id: hardcoded-jwt-secret\n    pattern: jwt.encode($DATA, \"...\", ...)\n    message: JWT secret should not be hardcoded\n    severity: ERROR\n```\n\n### Compliance Scanning\n```bash\n# PCI-DSS focused scan\nsemgrep --config p/pci-dss --json -o pci-scan-results.json\n```\n\n## Troubleshooting\n\n### High False Positive Rate\n- Review and tune rule sensitivity\n- Add path filters to exclude test files\n- Use nostmt metadata for noisy patterns\n- Create organization-specific rule exceptions\n\n### Performance Issues\n- Enable incremental scanning\n- Parallelize scans across modules\n- Optimize rule patterns for efficiency\n- Cache dependencies and scan results\n\n### Integration Failures\n- Verify API tokens and credentials\n- Check network connectivity and proxy settings\n- Review SARIF output format compatibility\n- Validate CI/CD runner permissions\n\n## Related Skills\n\n- OWASP Top 10 Checklist\n- Container Security\n- Dependency Scanning\n\n## Tool Comparison\n\n| Tool | Best For | Language Support | Cost | Integration |\n|------|----------|------------------|------|-------------|\n| Semgrep | Custom rules, fast scans | 30+ languages | Free/Enterprise | Excellent |\n| SonarQube | Code quality + security | 25+ languages | Free/Commercial | Good |\n| CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native |\n\n## Next Steps\n\n1. Complete initial SAST tool setup\n2. Run baseline security scan\n3. Create custom rules for organization-specific patterns\n4. Integrate into CI/CD pipeline\n5. Establish security gate policies\n6. Train development team on findings and remediation",
  "applicable_domains": [
    "other"
  ],
  "category": "other",
  "invocation": [
    "/sast-configuration"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/sast-configuration",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/sast-configuration",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "other"
  ],
  "lifecycle": "draft"
}