sast-skills

Why we included this project

Most security scanning tools expect you to install a separate pipeline, but this one works inside the AI coding assistant you already use. It's a set of agent skills that orchestrate a three-step review: the assistant first maps your codebase's architecture, entry points, and data flows, then runs thirteen parallel checks for vulnerability classes like SQL injection, XSS, SSRF, IDOR, and weak JWT handling, and finally merges everything into a report ranked by severity with remediation steps. Each detection skill works in two phases, recon first and then verification, which is a sensible way to get the model to confirm a finding is actually exploitable instead of just pattern-matching. For a small team that wants a lightweight security pass without standing up dedicated tooling, this slots into the workflow you already have, and it covers business-logic flaws that signature-based scanners tend to miss.