home / Security / SAST Scanning Skill by @BagelHole

SAST Scanning Skill by @BagelHole

FREE

github stars★ 1,180updatedJan 2026repo@BagelHole

$git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills

The skill is the security/scanning/sast-scanning folder inside that repository. Copy it into the folder your agent loads skills from; check your agent's documentation for where that is.

about SAST Scanning Skill by @BagelHole

Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube.

our take

Static application security testing with Semgrep, CodeQL and SonarQube, including a comparison of the tools, installation and how to find vulnerabilities in source before deployment.

when to use it

You are adding security scanning to a CI pipeline
You are choosing between static analysis tools
You want vulnerabilities found before release

before you install

Static tools produce false positives, so plan triage time
Scanning does not replace code review or dynamic testing

what's inside

The original SKILL.md is organised into these sections:

When to Use This Skill
Prerequisites
Tool Comparison
Semgrep
Installation
Basic Usage
Custom Rules
CI Configuration
CodeQL
Setup
Custom Queries
SonarQube

source and license

Written and maintained by @BagelHole. It is published under the MIT license, which allows reuse with attribution. SkillDirectory does not claim authorship: this page adds our own review and links back to the original, and the skill's text belongs to its author.

View the full SKILL.md on GitHub ↗

Read the opening of the original SKILL.md

# SAST Scanning

Identify security vulnerabilities in source code through static analysis.

## When to Use This Skill

Use this skill when:
- Implementing secure SDLC practices
- Adding security gates to CI/CD
- Automating code security reviews
- Finding vulnerabilities before deployment
- Meeting compliance requirements

## Prerequisites

- Source code access
- CI/CD pipeline
- SAST tool installation

## Tool Comparison

| Tool | License | Languages | Best For |
|------|---------|-----------|----------|
| Semgrep | OSS/Commercial | 30+ | Custom rules, speed |
| CodeQL | Free (GitHub) | 10+ | Deep analysis |
| SonarQube | OSS/Commercial | 25+ | Quality + Security |
| Bandit | OSS | Python | Python projects |
| Brakeman | OSS | Ruby | Rails apps |

## Semgrep

### Installation

```bash
# Install via pip
pip install semgrep

# Or via Homebrew
brew install semgrep
```

### Basic Usage

```bash
# Run with default rules
semgrep --config auto .

# Run specific rulesets
…

Excerpt only, quoted from the author's repository. Open the repository for the complete file.

↓ download .zip