Which SAST tools are supported by this skill?

The skill provides specialized configuration guidance for Semgrep, SonarQube, and CodeQL, covering both open-source and enterprise setups.

Does it support CI/CD integration?

Absolutely. It provides specific YAML templates and scripts for integrating security scanning into GitHub Actions, GitLab CI, and other major automation platforms.

Is this skill suitable for compliance-heavy industries?

Yes, it offers patterns for configuring scans and quality gates to meet various compliance frameworks like PCI-DSS, OWASP Top 10, and SOC 2.

Can this skill help reduce false positives in security scans?

Yes, it includes best practices for rule tuning, path exclusion, and metadata management to minimize noise and improve scan accuracy.

SAST Configuration

Name: SAST Configuration
Author: Microck

byMicrock

•

Security & Testing

Configures and optimizes Static Application Security Testing (SAST) tools to automate vulnerability detection in application code.

This skill provides specialized guidance for implementing Static Application Security Testing (SAST) across modern development environments. It helps developers and security engineers deploy and fine-tune industry-standard tools such as Semgrep, SonarQube, and CodeQL. By providing implementation patterns for CI/CD integration, custom security rule creation, and false positive management, the skill enables teams to establish robust DevSecOps practices and maintain high security standards throughout the software development lifecycle.

Key Features

0181 GitHub stars

02CI/CD pipeline integration for GitHub Actions, GitLab, and Jenkins

03Optimization strategies to reduce scan latency and false positive rates

04Quality gate configuration for PCI-DSS and SOC 2 compliance

05Custom security rule development using pattern matching and logic

06Comprehensive setup guides for Semgrep, SonarQube, and CodeQL

Use Cases

01Developing custom Semgrep rules to detect proprietary or domain-specific vulnerabilities

02Setting up automated security scanning for a new multi-language repository

03Implementing security quality gates to block vulnerable code from reaching production

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add microck/ordinary-claude-skills sast-configuration

For use in Claude.ai and ChatGPT

Download Skill