📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills security-scanning-security-sast
📦
security-scanning-security-sast
Content revision r2 High Risk ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Scan Source Code for Security Vulnerabilities
Manual security review can miss recurring vulnerabilities across large, mixed-language repositories. This skill configures SAST tools, triages findings, and suggests focused remediations.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "security-scanning-security-sast" from https://skillstore.io/skills/sickn33-security-scanning-security-sast.md and its manifest at https://skillstore.io/api/skills/sickn33-security-scanning-security-sast/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "security-scanning-security-sast". Review a Python API for SQL injection and command injection.
Expected outcome:
- High: User input reaches a shell command without strict argument validation.
- High: A query uses string formatting instead of parameters.
- Recommendation: Use argument arrays, input allowlists, and parameterized queries.
Using "security-scanning-security-sast". Choose SAST tools for a TypeScript and Python repository.
Expected outcome:
Use Semgrep across both languages, Bandit for Python, and ESLint Security for TypeScript. Run each tool in CI with pinned versions.
Using "security-scanning-security-sast". Summarize a scan containing repeated findings.
Expected outcome:
Group duplicates by root cause, preserve affected locations, prioritize reachable high-impact issues, and mark uncertain results for manual review.
Security Audit
High Riskv7 • 8/26/2026 Open versioned report
Most static findings are false positives caused by documentation, detection rules, and secure examples. The ping example permits argument injection, while semantic review found unsafe path containment, suppressed CI failures, swallowed scanner errors, and unpinned tooling.
1
Files scanned
502
Lines analyzed
1
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Unsafe Path Containment Check
The secure path example uses string startswith for containment. A sibling path sharing the allowed prefix can pass this check and permit unintended file access.
The code directly compares canonical path strings by prefix, a known boundary error when paths such as uploads-other share the allowed prefix.
High
SAST CI Failures Are Suppressed
The CI examples append || true to scanner commands. Findings, crashes, or configuration errors therefore cannot fail the security job.
Both CI examples explicitly convert every nonzero scanner exit into success, defeating enforcement and masking operational failures.
Medium
Scanner Errors Produce Incomplete Results
The scanner catches every Semgrep exception, prints it, and continues. Callers can receive a normal summary without knowing that one or more rulesets failed.
The broad exception handler records no failure state and does not rethrow, while the outer workflow always generates a summary.
Medium
Unpinned Security Tool Installation
Installation examples fetch current package and action versions without immutable pins. A compromised or incompatible release could affect CI execution and scan integrity.
The examples install Bandit, Semgrep, and ESLint without versions and reference GitHub Actions by mutable major tags rather than commit hashes.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Python subprocess.run
subprocess.run(['ping', '-c', '4', user_input]) # Array args
Array arguments prevent shell metacharacter injection, but unvalidated user_input can begin with a dash and inject ping options. This can alter network behavior or trigger resource-intensive modes.
Risk Factors
⚡ Contains scripts (2)
⚙️ External commands (50)
SKILL.md:239 SKILL.md:383 SKILL.md:144 SKILL.md:143 SKILL.md:235 SKILL.md:28 SKILL.md:52-57 SKILL.md:57-59 SKILL.md:59-60 SKILL.md:60-64 SKILL.md:64-68 SKILL.md:68-71 SKILL.md:71-73 SKILL.md:73-74 SKILL.md:74-86 SKILL.md:86-90 SKILL.md:90-96 SKILL.md:96-98 SKILL.md:98-99 SKILL.md:99-154 SKILL.md:154-158 SKILL.md:158-159 SKILL.md:159-160 SKILL.md:160-161 SKILL.md:161-170 SKILL.md:170-174 SKILL.md:174-181 SKILL.md:181-191 SKILL.md:191-198 SKILL.md:198-202 SKILL.md:202-209 SKILL.md:209-219 SKILL.md:219-226 SKILL.md:226-231 SKILL.md:231-238 SKILL.md:238-242 SKILL.md:242-249 SKILL.md:249-253 SKILL.md:253-262 SKILL.md:262-277 SKILL.md:277-284 SKILL.md:284-291 SKILL.md:291-298 SKILL.md:298-305 SKILL.md:305-309 SKILL.md:309-423 SKILL.md:423-429 SKILL.md:429-461 SKILL.md:461-465 SKILL.md:465-476
🌐 Network access (2)
📁 Filesystem access (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-security-scanning-security-sast/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-security-scanning-security-sast?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-security-scanning-security-sast?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-security-scanning-security-sast/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-security-scanning-security-sast.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). security-scanning-security-sast security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-security-scanning-security-sast/audits/7BibTeX citation
@techreport{sickn33-sickn33-security-scanning-security-sast-2026,
author = {sickn33},
title = {security-scanning-security-sast security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/sickn33-security-scanning-security-sast/audits/7},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-scanning-security-sast security audit report (audit version 7)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-08-26"
url: "https://skillstore.io/skills/sickn33-security-scanning-security-sast/audits/7"
identifiers:
- type: other
value: "skillstore:sickn33-security-scanning-security-sast:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
78
Spec Compliance
What You Can Build
Review a Pull Request
Identify security-sensitive changes, run relevant SAST checks, and prioritize actionable findings before merge.
Build a Security Pipeline
Choose scanners, configure CI jobs, preserve reports, and define clear failure policies.
Create Custom Detection Rules
Translate internal secure coding requirements into focused Semgrep rules with testable examples.
Try These Prompts
Basic Repository Scan
Identify this repository's languages and frameworks. Recommend suitable SAST tools and list the commands needed for an initial scan.
Triage Scanner Findings
Review these SAST findings. Remove clear false positives, rank exploitable issues by severity, and explain each recommended fix.
Secure a Framework
Assess this Django, Flask, or Express configuration for common security weaknesses. Provide framework-specific fixes and validation steps.
Design a SAST Program
Design a multi-language SAST pipeline for this repository. Include tool selection, pinned dependencies, custom rules, baselines, failure policies, and report retention.
Best Practices
- Run scanners with pinned versions and reviewed rulesets in isolated CI environments.
- Validate findings against data flow, reachability, and application context before changing production code.
- Fail closed on scanner errors while separating tool failures from confirmed vulnerability policy violations.
Avoid
- Do not treat every scanner match as an exploitable vulnerability.
- Do not suppress scanner exit codes without recording and evaluating the failure.
- Do not upload proprietary source code to external scanning services without approval.
Frequently Asked Questions
Which languages are supported?
The guidance covers Python, JavaScript, TypeScript, Java, Ruby, PHP, Go, and Rust, depending on available scanners.
Does this replace penetration testing?
No. SAST examines source code and should complement runtime testing, threat modeling, and expert review.
Can it run in CI?
Yes. The skill includes GitHub Actions and GitLab CI patterns that should be hardened before production use.
How should false positives be handled?
Validate reachability and context, document accepted risk, and tune rules narrowly without hiding unrelated findings.
Can it create custom rules?
Yes. It provides Semgrep rule patterns that can be adapted to internal policies and tested against representative code.
Does it handle secrets scanning?
It covers basic hardcoded secret patterns. Dedicated secret scanners remain necessary for deeper history and credential analysis.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
4804b3d672af16b8afca785bbb6c5d7c7400a78f
Maintenance freshness
8/26/2026
Usage
13 downloads · 107 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-architect
81Review Architecture Workflows and Project Paths
Architecture reviews need a consistent starting point and clear project boundaries. This skill provides workspace-scoped tool templates, command examples, and generic design references.
Coding & Development View
📦
senior-fullstack
81Review Fullstack Project Foundations
Fullstack project setup can require many tools and checks. This skill provides basic local wrappers, common commands, and general engineering guidance.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
sast-configuration
79Configure SAST for DevSecOps Pipelines
by wshobson
Teams need repeatable security scans before code reaches production. This skill guides SAST setup, rule tuning, and CI gate configuration.
Security & Compliance View
📦
security-sentinel
79Audit Code for Security Risks
by Barnhardt-Enterprises-Inc
Security-sensitive code is easy to ship with hidden flaws in authentication, input handling, and secrets. This skill gives Claude, Codex, and Claude Code structured security references and scanner guidance for safer reviews.
Security & Compliance View
📦
vibe-security
38Audit Code Security with Vibe Security
by 0x8506
Security reviews are hard to run consistently across languages and frameworks. This skill guides Claude, Codex, and Claude Code through vulnerability scanning, dependency checks, fix suggestions, and report generation.
Security & Compliance View
📦
senior-secops
81Automate SecOps Checks
by alirezarezvani
Security teams need consistent review workflows across projects. This skill provides SecOps CLI scaffolds and reference guides for repeatable checks.
Security & Compliance View
📦
pytm
81Build pytm Threat Models as Code
by AgentSecOps
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Security & Compliance View
📦
security-analyzer
80Analyze Project Security Risks
by Cornjebus
Security reviews are slow when dependency, container, and IaC data are spread across a repository. This skill inventories assets, checks OSV.dev, and drafts prioritized remediation reports.
Security & Compliance View