Which SAST tools does this skill support?

This skill provides comprehensive guidance for configuring and optimizing Semgrep, SonarQube, and CodeQL across various programming environments.

Does it support CI/CD integration?

Absolutely. It provides templates and patterns for integrating SAST tools into GitHub Actions, GitLab CI, Jenkins, and pre-commit hooks.

Can I create custom security rules with this skill?

Yes, it offers detailed guidance on developing custom patterns and queries to detect unique security vulnerabilities specific to your application.

Can this skill help reduce false positives in security scans?

Yes, it includes specific strategies for rule tuning, path exclusions, and incremental scanning to ensure results are accurate and actionable.

SAST Tooling & Security Configuration

Name: SAST Tooling & Security Configuration
Author: Microck

byMicrock

•

Security & Testing

Configures and optimizes Static Application Security Testing (SAST) tools to automate vulnerability detection and enforce secure coding standards.

This skill empowers developers and security engineers to implement robust DevSecOps practices by providing expert guidance on setting up, configuring, and tuning industry-standard SAST tools like Semgrep, SonarQube, and CodeQL. It streamlines the process of integrating security scanning into CI/CD pipelines, creating custom security rules tailored to specific codebases, and establishing quality gates to prevent vulnerable code from reaching production. By focusing on performance optimization and false-positive reduction, this skill ensures that security testing remains an efficient and actionable part of the development lifecycle.

Key Features

01Quality gate setup and compliance policy enforcement

02Expert configuration for Semgrep, SonarQube, and CodeQL

0381 GitHub stars

04Performance tuning and false positive management

05Automated CI/CD integration for GitHub, GitLab, and Jenkins

06Custom security rule development with pattern matching

Use Cases

01Configuring security-focused quality gates for PCI-DSS or SOC 2 compliance

02Setting up automated security scanning for a new multi-language repository

03Implementing custom detection patterns for organization-specific vulnerabilities

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add microck/ordinary-claude-skills sast-configuration

For use in Claude.ai and ChatGPT

Download Skill