# sast-skills

A collection of agent skills that turn your LLM coding assistant into a fully functional SAST scanner to find vulnerabilities in your codebase. Works natively with Claude Code, Codex, Opencode, Cursor and any other assistant that supports agent skills.

- Tier: Indexed (plain plugin)
- Category: Security
- Page: https://www.flowy.sh/listings/utkusen-sast-skills
- Source: https://github.com/utkusen/sast-skills
- Price: free and open source

## Summary
sast-skills is a Claude Code plugin with 16 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes sast-analysis, sast-businesslogic, sast-fileupload. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

## Install (Claude Code)
```
npx -y skills add utkusen/sast-skills --agent claude-code
```

## Skills
- sast-analysis
- sast-businesslogic
- sast-fileupload
- sast-graphql
- sast-hardcodedsecrets
- sast-idor
- sast-jwt
- sast-missingauth
- sast-pathtraversal
- sast-rce
- sast-report
- sast-sqli
- sast-ssrf
- sast-ssti
- sast-xss
- sast-xxe

## FAQ

### What is sast-skills?
A collection of agent skills that turn your LLM coding assistant into a fully functional SAST scanner to find vulnerabilities in your codebase. Works natively with Claude Code, Codex, Opencode, Cursor and any other assistant that supports agent skills.

### How do I install sast-skills?
Run these in Claude Code: npx -y skills add utkusen/sast-skills --agent claude-code. Then prompt normally.

### Does sast-skills auto-invoke its skills?
Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

### Is sast-skills free?
Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.