Is this suitable for large enterprise codebases?

Absolutely. It covers performance optimization techniques like incremental scanning, parallelization, and caching to handle large-scale projects efficiently.

Does it provide a way to handle false positives?

Yes, the skill includes best practices for tuning rule sensitivity, excluding specific paths, and creating documented suppressions to reduce noise.

Which SAST tools does this skill support?

This skill provides configuration guidance for Semgrep, SonarQube, and CodeQL, covering a wide range of programming languages and integration patterns.

Can I use this for custom security rules?

Yes, it includes detailed instructions and templates for creating custom patterns and rules tailored to your specific codebase and compliance requirements.

How does it help with DevSecOps implementation?

It provides ready-to-use CI/CD integration patterns, such as GitHub Actions and pre-commit hooks, to automate security checks at every stage of the development lifecycle.

SAST Security Scanning

Name: SAST Security Scanning
Author: nguyendinhquocx

bynguyendinhquocx

セキュリティとテスト

Configures and optimizes Static Application Security Testing (SAST) tools to automate vulnerability detection and enforce security policies across codebases.

概要

This skill enables developers and security engineers to implement robust DevSecOps practices by setting up and fine-tuning industry-standard SAST tools like Semgrep, SonarQube, and CodeQL. It provides specialized guidance on creating custom security rules, integrating scans into CI/CD pipelines, and managing false positives to ensure high-quality, secure code delivery across multiple programming languages. Whether you are conducting a baseline security audit or establishing a permanent security gate, this skill provides the templates and configurations necessary for comprehensive static analysis.

主な機能

0 GitHub stars
Custom security rule development with pattern matching
Automated CI/CD pipeline integration and quality gate setup
Multi-tool configuration for Semgrep, SonarQube, and CodeQL
False positive management and rule tuning strategies
Performance optimization for large-scale security scanning

ユースケース

Setting up automated security scans for a new software project
Developing custom security rules to detect organization-specific vulnerabilities
Integrating SAST tools into GitHub Actions or GitLab CI for continuous monitoring

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add nguyendinhquocx/code-ai sast-configuration

For use in Claude.ai and ChatGPT

Download Skill

GitHub

概要