How does this help with false positives?

The skill offers strategies for rule tuning, creating allow lists, and implementing documented suppressions to ensure high-quality, actionable security findings.

Is this suitable for compliance audits?

Yes, it includes specific configurations and scanning patterns designed to help meet security standards like PCI-DSS and SOC 2.

Can I use this for CI/CD integration?

Yes, it includes templates and patterns for integrating security scans into GitHub Actions, GitLab CI, and Jenkins pipelines.

Which SAST tools does this skill support?

It provides configuration guidance for Semgrep, SonarQube, and CodeQL, covering a wide range of programming languages and environments.

SAST Security Configuration

Name: SAST Security Configuration
Author: Activer007

byActiver007

0•

セキュリティとテスト

Configures and optimizes Static Application Security Testing (SAST) tools to automate vulnerability detection in source code.

This skill enables developers to implement comprehensive security scanning using industry-leading tools like Semgrep, SonarQube, and CodeQL. It provides structured guidance on setting up CI/CD pipelines, creating custom security rules, managing false positives, and enforcing compliance policies across multiple programming languages. Whether establishing a security baseline for a new project or optimizing an existing DevSecOps workflow, this skill helps ensure that code vulnerabilities are identified and remediated early in the development lifecycle.

主な機能

01Performance optimization and false positive reduction strategies

020 GitHub stars

03Custom security rule development and pattern matching

04Multi-tool support for Semgrep, SonarQube, and CodeQL configuration

05Compliance-focused scanning for PCI-DSS and SOC 2 requirements

06CI/CD pipeline integration for automated security gates

ユースケース

01Developing custom security rules to catch organization-specific vulnerabilities

02Establishing security baselines and quality gates for new software projects

03Setting up automated security scanning in GitHub Actions or GitLab CI

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add activer007/ordinary-claude-skills sast-configuration

For use in Claude.ai and ChatGPT

Download Skill