rea
Reverse engineer anything with agents, from app behavior down to native binaries.
420k
@morlutoSecurity
Plugin
sast-skills
Turns your coding assistant into a security scanner that checks your codebase for vulnerabilities such as business logic flaws, insecure file uploads, GraphQL injection and hardcoded secrets, without any third-party tools. Works with Claude Code, Codex, Cursor and other agent-skill assistants.
Plugin Signal81/100Strong
maintained96
capable59
documented100
adopted67
Claude Code
$ npx -y skills add utkusen/sast-skills --agent claude-code
Codex
$ npx skills add utkusen/sast-skills -a codex
Cursor
$ npx skills add utkusen/sast-skills -a cursor
Gemini CLI
$ npx skills add utkusen/sast-skills -a gemini-cli
GitHub Copilot
$ npx skills add utkusen/sast-skills -a github-copilot
OpenCode
$ npx skills add utkusen/sast-skills -a opencode
Windsurf
$ npx skills add utkusen/sast-skills -a windsurf
Stats
1,371
Stars
71
Forks
Active
Maintenance
MIT
License
Last commit
Created
What's inside
16 Skills
/sast-analysisPerform codebase analysis and architecture mapping as the first phase of a security assessment. Explores the tech stack, frameworks, entry points, data flows, and trust boundaries. Outputs sast/architecture.md. Run this before any vulnerability detection skill. Use when asked to/sast-businesslogicDetect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price/sast-fileuploadDetect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires/sast-graphqlDetect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge/sast-hardcodedsecretsDetect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm/sast-idorDetect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge (consolidate batch results). Checks endpoints for missing
README
LLM SAST Skills
A collection of agent skills that turn your LLM coding assistant into a fully functional SAST scanner to find vulnerabilities in your codebase. Works natively with Claude Code, Codex, Opencode, Cursor and any other assistant that supports agent skills. No third-party tools required.
The main goal of this project is to find as many vulnerabilities as possible at the lowest possible cost.
How It Works
CLAUDE.md (for Claude Code) or AGENTS.md (for Opencode and other IDEs) orchestrates the entire assessment workflow automatically. The assessment runs in three steps:
-
Codebase Analysis -- The
sast-analysisskill maps the technology stack, architecture, entry points, data flows, and trust boundaries. It writes its findings tosast/architecture.md. -
Vulnerability Detection (parallel) -- All 13 vulnerability detection skills run in parallel as subagents. Each skill follows a two-phase approach: first a recon/discovery phase to find candidate sections, then a verification phase to confirm exploitability. Results are written to
sast/*-results.md. -
Report Generation -- The
sast-reportskill consolidates all findings into a singlesast/final-report.md, ranked by severity with full remediation guidance and dynamic test instructions.
What It Detects
| Skill | Vulnerability Class |
|---|---|
| sast-analysis | Codebase reconnaissance, architecture mapping, threat modeling |
| sast-sqli | SQL Injection |
| sast-graphql | GraphQL injection |
| sast-xss | Cross-Site Scripting (XSS) |
| sast-rce | Remote Code Execution (command injection, eval, unsafe deserialization) |
| sast-ssrf | Server-Side Request Forgery |
| sast-idor | Insecure Direct Object Reference |
| sast-xxe | XML External Entity |
| sast-ssti | Server-Side Template Injection |
| sast-jwt | Insecure JWT implementations |
| sast-missingauth | Missing authentication and broken function-level authorization |
| sast-pathtraversal | Path / directory traversal |
| sast-fileupload | Insecure file upload |
| sast-businesslogic | Business logic flaws (price manipulation, workflow bypass, race conditions, etc.) |
| sast-report | Consolidated final report ranked by severity |
Installation
Copy your project into the sast-files folder, then open sast-files as your workspace in your AI coding assistant.
cp -r /path/to/your/project sast-files/
Note: If your project already contains a
CLAUDE.mdorAGENTS.mdfile, remove it before running the assessment — otherwise it will conflict with the orchestration file provided by this toolkit.
Usage
After copying the files, open your project in your AI coding assistant and ask:
Run vulnerability scan
or
Find vulnerabilities in this codebase
The entry point file (CLAUDE.md or AGENTS.md) orchestrates the full workflow automatically. It will skip any steps whose output files already exist, so you can safely re-run it after fixing issues.
Output
All output is written to a sast/ folder in your project root:
| File | Description |
|---|---|
sast/architecture.md | Technology stack, architecture, entry points, data flows |
sast/*-results.md | Per-vulnerability-class findings with proof and remediation |
sast/final-report.md | Consolidated report ranked by severity |
Stars on GitHub
Momentum
- stars in total
- 1.4k
File tree
Similar plugins.
See 12 sast-skills alternatives
@morlutoreverse-skill
A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
46 skills44k
@zhaoxuya520cybersecurity-skills
Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
200 skills36k
@mukul975watermarks-remover
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
2 skills1 hook26k
@guillaumemeyerQuestions about sast-skills.
Install it with the command on its page. It includes sast-analysis, sast-businesslogic, sast-fileupload. Its skills do not fire on their own yet. Free and open source.
- What is sast-skills?
- utkusen/sast-skills is a collection of skills and agents that turn an LLM coding assistant into a SAST scanner for finding vulnerabilities in a codebase. Use it for security audits, covering areas such as business logic flaws, insecure file uploads, GraphQL injection and hardcoded secrets.
- How do I install sast-skills?
- Run these in Claude Code: npx -y skills add utkusen/sast-skills --agent claude-code. Then prompt normally.
- Does sast-skills auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin.
- Is sast-skills free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
- Which coding agents can use sast-skills's skills?
- sast-skills installs in Claude Code, and its skills also install in Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI. Each skill's page has the install command. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it