Claude MarketplacesSubmit
wshobson avatar

Sast Configuration

wshobson/agents

Takes the pain out of setting up SAST tools like Semgrep, SonarQube, and CodeQL in your CI/CD pipeline. Generates ready-to-use config files, pre-commit hooks, and GitHub Actions workflows that actually work. Covers custom rule creation for catching organization-specific security anti-patterns, tuning quality gates to reduce false positives, and integrating multiple scanners without breaking your build times. The troubleshooting section alone will save you hours of debugging why your CodeQL database won't build or why Semgrep is flagging every test file. Best when you need to go from zero to automated security scanning without reading documentation for three different tools.

skills.sh installs
11.2K
GitHub stars
42.4K
last updated
Aug 21, 2026
View on GitHub

Install

$ npx -y skills add wshobson/agents --skill sast-configuration --agent claude-code

Installs into .claude/skills of the current project.

Files

SAST Configuration

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.

Overview

This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. Use this skill when you need to:

  • Set up SAST scanning in CI/CD pipelines
  • Create custom security rules for your codebase
  • Configure quality gates and compliance policies
  • Optimize scan performance and reduce false positives
  • Integrate multiple SAST tools for defense-in-depth

Core Capabilities

1. Semgrep Configuration

  • Custom rule creation with pattern matching
  • Language-specific security rules (Python, JavaScript, Go, Java, etc.)
  • CI/CD integration (GitHub Actions, GitLab CI, Jenkins)
  • False positive tuning and rule optimization
  • Organizational policy enforcement

2. SonarQube Setup

  • Quality gate configuration
  • Security hotspot analysis
  • Code coverage and technical debt tracking
  • Custom quality profiles for languages
  • Enterprise integration with LDAP/SAML

3. CodeQL Analysis

SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Details

Repository
github.com/wshobson/agents
Categories
Testing & QA, Security, Automation & Workflows

More from wshobson/agents

All 174

Recommended

More Testing & QA
1github avatarcsharp-xunitgithub/awesome-copilotGet best practices for XUnit unit testing, including data-driven tests10.4Kskills.sh installs
2jeffallan avatarpython-projeffallan/claude-skillsUse when building Python 3.11+ applications requiring type safety, async programming, or robust error handling. Generates type-annotated Python code, configures9.1Kskills.sh installs
3github avatarcsharp-nunitgithub/awesome-copilotGet best practices for NUnit unit testing, including data-driven tests9Kskills.sh installs
4github avatarcsharp-mstestgithub/awesome-copilotGet best practices for MSTest 3.x/4.x unit testing, including modern assertion APIs and data-driven tests8.9Kskills.sh installs
5github avatarcsharp-tunitgithub/awesome-copilotGet best practices for TUnit unit testing, including data-driven tests8.9Kskills.sh installs
6nousresearch avatardogfoodnousresearch/hermes-agentExploratory QA of web apps: find bugs, evidence, reports.6.4Kskills.sh installs