sast-runner

naporin0624's avatarfrom naporin0624

Runs Static Application Security Testing (SAST) using Semgrep. Scans source code for vulnerabilities, security anti-patterns, and OWASP Top 10 issues. Use when user asks to "run SAST", "scan for vulnerabilities", "static analysis", "code security scan", "静的解析", "脆弱性スキャン".

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 26, 2025
[Security Operations]

When & Why to Use This Skill

The SAST Runner skill provides an automated solution for Static Application Security Testing (SAST) by integrating the Semgrep engine directly into the Claude environment. It solves the critical problem of identifying security vulnerabilities early in the development lifecycle by scanning source code for anti-patterns, OWASP Top 10 risks, and CWE-listed flaws across multiple programming languages, ensuring robust application security and compliance.

Use Cases

  • Automated Security Auditing: Quickly scan entire repositories to detect high-risk vulnerabilities like SQL injection, Cross-Site Scripting (XSS), and Path Traversal.
  • Compliance Verification: Ensure codebases adhere to industry standards such as the OWASP Top 10 and CWE/SANS Top 25 through targeted rulesets.
  • Pre-deployment Code Review: Use as an automated security gate to identify and fix security anti-patterns before code is merged or deployed to production.
  • Multi-Language Vulnerability Scanning: Perform consistent security analysis across diverse tech stacks including JavaScript, Python, Go, Java, and Rust using a single tool.
namesast-runner
descriptionRuns Static Application Security Testing (SAST) using Semgrep. Scans source code for vulnerabilities, security anti-patterns, and OWASP Top 10 issues. Use when user asks to "run SAST", "scan for vulnerabilities", "static analysis", "code security scan", "静的解析", "脆弱性スキャン".

SAST Runner

Wrapper for Semgrep to perform Static Application Security Testing.

Prerequisites

Semgrep must be installed:

# pip
pip install semgrep

# macOS
brew install semgrep

# Docker
docker pull semgrep/semgrep

Usage

# Scan current directory with auto config
npx sast-runner .

# Scan with specific ruleset
npx sast-runner . --config security-audit

# Scan with JSON output
npx sast-runner . --json

# Available rulesets
npx sast-runner --list-configs

# Check if semgrep is installed
npx sast-runner --check

Rulesets

Config Description
auto Auto-detect languages and apply relevant rules
security-audit Comprehensive security audit
owasp-top-ten OWASP Top 10 focused
cwe-top-25 CWE/SANS Top 25
default Default ruleset

Output Format

{
  "tool": "semgrep",
  "scanPath": ".",
  "findings": [
    {
      "id": "javascript.express.security.audit.xss.mustache-escape",
      "severity": "high",
      "message": "Potential XSS vulnerability",
      "file": "src/app.js",
      "line": 42,
      "code": "res.send(userInput)",
      "cwes": ["CWE-79"],
      "owasp": ["A03:2021"],
      "fix": "Use proper output encoding"
    }
  ],
  "summary": {
    "total": 1,
    "critical": 0,
    "high": 1,
    "medium": 0,
    "low": 0
  }
}

Exit Codes

  • 0: No issues found
  • 1: Issues detected
  • 2: Tool not installed or error

CWE Coverage

Common vulnerabilities detected:

  • CWE-89: SQL Injection
  • CWE-79: Cross-site Scripting (XSS)
  • CWE-78: OS Command Injection
  • CWE-94: Code Injection
  • CWE-22: Path Traversal
  • CWE-502: Deserialization of Untrusted Data
  • CWE-200: Exposure of Sensitive Information

Supported Languages

JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, C, C++, Rust, Kotlin, Swift, and more.